RFR(XS): 8027626: assert(Opcode() != Op_If || outcnt() == 2) failed: bad if #1

[Roland Westrelin]

Hi Kris,

> Do you have a regression test case that can show the bug and show the fix works?

I don’t have a simple test case. For the bug to appear, the IGVN needs to process the nodes in a specific order. I don’t see how to get it to do that with a simple test case.

Roland.

> I noticed the replay file in the bug report, but a runnable test case (not just replaying) would give me a better sense. Thanks!
> 
> Best regards,
> Kris
> 
> On Mon, Jan 5, 2015 at 1:33 PM, Roland Westrelin <roland.westrelin at oracle.com> wrote:
> Hi Vladimir,
> 
> Thanks for looking at this.
> 
> > I think correct fix will be eager dead 12212 If node elimination when 12214 is replaced by 18733. Keep it connected to graph can cause problems in other places.
> 
> IfFalseNode::Identity() is what optimizes 12212/12214 out. Should I make it an Ideal transformation so that I can call igvn->remove_dead_node() on the dead branch?
> 
> Roland.
> 
> >
> > Thanks,
> > Vladimir
> >
> > On 1/5/15 7:48 AM, Roland Westrelin wrote:
> >> http://cr.openjdk.java.net/~roland/8027626/webrev.00/
> >>
> >> The following subgraph is where the bug shows up:
> >>
> >> If (18732)
> >> |     \
> >> IfTrue IfFalse
> >> (18734) (18733)
> >> | |
> >> | If (12212)
> >> | |     \
> >> | IfFalse IfTrue
> >> | (12214)
> >> | |
> >> Region (12183)
> >>
> >> Condition to 12212 is always false so 12214 is replaced by 18733 and both branches of If 18732 are directly connected to Region 12183. 18733 still has dead 12212 as output.
> >> 12183 doesn't have phis so when it's transformed, If 18732 is considered for removal. IfTrue 18734 doesn't have uses anymore so it goes away but IfFalse 18733 still has some (dead branch 12212 is not yet removed).
> >> An If in the dead branch 12212 is processed. Range check smearing follows dominator controls until 18733, tests whether the If is a range check and the assert fires because the If only has one projection.
> >>
> >> So we’re trying to optimize a dead branch. I fixed it by making the range check code more robust.
> >>
> >> Roland.
> >>
> 
>