RFR(XS): 8143307: Crash in C2 local code motion

[Lindenmaier, Goetz]

Hi,



We see assert(i < _max) failed: oob: i=1, _max=1  in C2s local code motion.



lcm.cpp:502 accesses e->in(1)->in(1) where e is an Op_CountedLoopEnd.

e->in(1) should return a loop iteration node. In the failing case the loop iteration node has been optimized out and replaced by a Proj, which has no in(1).



In detail, in the ideal world, I could observe the following optimization steps:



1.) If( Proj_lt (Cmp(AddI(Proj_res(Call(...)), -1) LoadI(...) ) )

2.) CountedLoopEnd( Proj_lt (Cmp(AddI(Proj_res(Call(...)), -1) LoadI(...) ) )

3.) CountedLoopEnd( Proj_le (Cmp(Proj_res(Call(...)), LoadI(...) ) )

4.) CountedLoopEnd( Proj_le(Cmp(x,y))) was matched into one mach node:

     Branch_loopEnd(Proj_res(Call(...)), LoadI(...) )



On pattern 4.) e->in(1)->in(1) fails.



Fix: check whether e->in(1)->req() > 1.



Please review this change. I please need a sponsor.

http://cr.openjdk.java.net/~goetz/webrevs/8143307-lcmCrash/webrev.00/



Best regards,

  Goetz.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.openjdk.java.net/pipermail/hotspot-compiler-dev/attachments/20151119/4a0eabdd/attachment-0001.html>