SIGSEGV in C2 Node::unique_ctrl_out on 11.0.4

[Vitaly Davidovich]

Hi all,

We're seeing the below segfault occur sporadically when running Ant (i.e.
org.apache.tools.ant.launch.Launcher) as part of a build.  This is OpenJDK
11.0.4.  I've not reported it there (yet) - wanted to see if the backtrace
rings a bell for any experts on this list.

I can share more details of the hs_err file.

#

# A fatal error has been detected by the Java Runtime Environment:

#

#  SIGSEGV (0xb) at pc=0x00001494dada6d7b, pid=53813, tid=53868

#

# JRE version: OpenJDK Runtime Environment (11.0.4+11) (build 11.0.4+11)

# Java VM: OpenJDK 64-Bit Server VM (11.0.4+11, mixed mode, tiered,
compressed oops, g1 gc, linux-amd64)

# Problematic frame:

# V  [libjvm.so+0xbcbd7b]  Node::unique_ctrl_out() const+0xb





Stack: [0x00001494b0351000,0x00001494b0452000],  sp=0x00001494b044cf00,
free space=1007k

Native frames: (J=compiled Java code, A=aot compiled Java code,
j=interpreted, Vv=VM code, C=native code)

V  [libjvm.so+0xbcbd7b]  Node::unique_ctrl_out() const+0xb

V  [libjvm.so+0xa8128e]  PhaseIterGVN::clone_loop_predicates(Node*, Node*,
bool)+0x4ce

V  [libjvm.so+0x84863b]  split_if(IfNode*, PhaseIterGVN*)+0x114b

V  [libjvm.so+0x84ad58]  IfNode::Ideal(PhaseGVN*, bool)+0x4a8

V  [libjvm.so+0xc5b5de]  PhaseIterGVN::transform_old(Node*)+0x6e

V  [libjvm.so+0xc58474]  PhaseIterGVN::optimize()+0x134

V  [libjvm.so+0x62f3c0]  Compile::Optimize()+0x580

V  [libjvm.so+0x63096a]  Compile::Compile(ciEnv*, C2Compiler*, ciMethod*,
int, bool, bool, bool, DirectiveSet*)+0xbea

V  [libjvm.so+0x5466bc]  C2Compiler::compile_method(ciEnv*, ciMethod*, int,
DirectiveSet*)+0xbc

V  [libjvm.so+0x63aa2d]
CompileBroker::invoke_compiler_on_method(CompileTask*)+0x49d

V  [libjvm.so+0x63c1d8]  CompileBroker::compiler_thread_loop()+0x598

V  [libjvm.so+0xdbd423]  JavaThread::thread_main_inner()+0x103

V  [libjvm.so+0xdbd6f5]  JavaThread::run()+0x2a5

V  [libjvm.so+0xdb93aa]  Thread::call_run()+0x13a

V  [libjvm.so+0xc01c9e]  thread_native_entry(Thread*)+0xee


Looking at the disassembly for unique_ctrl_out and where the signal is
generated, it would appear that the `this` ptr is null (i.e.
clone_loop_predicates() calls this method on a NULL).


Thanks!