RFR(S): 8240576: JVM crashes after transformation in C2 IdealLoopTree::merge_many_backedges
Yangfei (Felix)
felix.yang at huawei.com
Thu Mar 5 08:59:54 UTC 2020
Hi,
Looks like the formatting in the previous mail is bad. :- (
Attached please find the analysis file. It should have a better display when opened in a VI editor.
Thanks,
Felix
> -----Original Message-----
> From: Yangfei (Felix)
> Sent: Thursday, March 5, 2020 4:52 PM
> To: hotspot-compiler-dev at openjdk.java.net
> Subject: RFR(S): 8240576: JVM crashes after transformation in C2
> IdealLoopTree::merge_many_backedges
>
> Hi,
>
> Please help review this patch fixing a C2 bug.
> Bug: https://bugs.openjdk.java.net/browse/JDK-8240576
> Will prepare a webrev adding the test case later.
>
> There is an ordinary nested loop in the test case.
> When entrybci = -1. It has 5 reducible loop.
> Normal control flow looks like:
>
> +------+
> |0:Root |
> +------+
> |
> |
> v
> +---------+
> <----- |1:Region1|<-----------------+
> |if(i<100)|<---------+ |
> +---------+ | |
> | ^ | |
> | | | |
> v | | |
> +-----------+ | |
> |2:if(mF!=0)| | |
> +-----------+ | |
> | | |
> | | |
> v | |
> +---------+ | | try-catch
> |3:Region2| | |
> |if(j<101)|----------+ |
> +---------+ |
> | ^ |
> | | |
> v | |
> +---------+ |
> |4:Region3| |
> |if(k<102)| |
> +---------+ |
> | ^ |
> | | |
> v | |
> +-----------------------------+ |
> |5:int mI=new Interger(0x1234)|-----+
> +-----------------------------+
>
> Current CompileTask:
> C2: 13694 832 % !b Test::testMethod @ 37 (83 bytes)
>
> Problem triggered during the OSR compilation.
> It has 3 reducible loop and 1 irreducible loop.
> OSR control flow looks like:
>
> +------+
> |0:Root|
> +---+--+
> |
> |
> v
> +-----------------------------+ +----+----+
> |5:int mI=new Interger(0x1234)| <--------- |4:Region3|
> | |---------> |if(k<102)|
> +------------+----------------+ +--+--+---+
> | | ^
> | | |
> | v |
> | +---------+
> | |3:Region2|<-----------+
> | try-catch |if(j<101)| |
> | +---------+ |
> | | |
> | | |
> | v |
> | +---------+ |
> +--------------------------> |1:Region1|------> |
> |if(i<100)| |
> +---------+ |
> | ^ |
> | | |
> v | |
> +-----------+ |
> |2:if(mF!=0)|-----------+
> +-----------+
>
> In the first beautify_loops, something went wrong when c2 does
> merge_many_backedges.
>
> 2090 // If I am a shared header (multiple backedges), peel off the many
> 2091 // backedges into a private merge point and use the merge point as
> 2092 // the one true backedge.
> 2093 if( _head->req() > 3) {
> 2094 // Merge the many backedges into a single backedge but leave
> 2095 // the hottest backedge as separate edge for the following peel.
> 2096 merge_many_backedges( phase );
> 2097 result = true;
> 2098 }
>
> Subgraph before merge_many_backedges:
>
> | |
> | |
> | v
> | +---------+
> | try-catch |3:Region2|<-----------+
> | |if(j<101)| |
> | +---------+ |
> | | |
> | | |
> | v |
> | +---------+ |
> +--------------------------> |1:Region1| -----> |
> |if(i<100)| |
> +---------+ |
> | ^ |
> | | |
> v | |
> +-----------+ |
> |2:if(mF!=0)|-----------+
> +-----------+
>
>
> Before line 2096, IdealLoopTree looks like:
>
> IdealLoopTree:
> N1/N3 irreducible
> N1/N2 reducible
>
>
> Subgraph after merge_many_backedges:
>
> | |
> | |
> | v
> | +--+------+
> | try+catch |3:Region2|<-----------+
> | |if(j<101)| |
> | +---------+ |
> | | |
> | | |
> | v |
> | +----+----+ |
> +--------------------------> |1:Region1|-----> |
> |if(i<100)| |
> ++-------++ |
> | ^ |
> | | |
> | | |
> | +---------+ |
> | |6:Region3| |
> | +---------+ |
> | ^ |
> | | |
> v | |
> +-----------+ |
> |2:if(mF!=0)| -----------+
> +-----------+
>
> After line 2096, IdealLoopTree looks like:
>
> IdealLoopTree:
> N1/N6 irreducible
> N1/N3 reducible
>
> The overall structure of the loop remains the same, but its irreducible
> attributes has been modified incorrectly, which further leads to the vm crash.
> Proposed fix prevents doing merge_many_backedges when IdealLoopTree is
> irreducible.
>
> diff -r 67cc6f3948e3 src/hotspot/share/opto/loopnode.cpp
> --- a/src/hotspot/share/opto/loopnode.cpp Wed Mar 04 15:34:53 2020
> -0800
> +++ b/src/hotspot/share/opto/loopnode.cpp Thu Mar 05 09:32:57 2020
> +0800
> @@ -2091,7 +2091,7 @@
> // If I am a shared header (multiple backedges), peel off the many
> // backedges into a private merge point and use the merge point as
> // the one true backedge.
> - if( _head->req() > 3 ) {
> + if (_head->req() > 3 && !_irreducible) {
> // Merge the many backedges into a single backedge but leave
> // the hottest backedge as separate edge for the following peel.
> merge_many_backedges( phase );
>
> Tiered 1-3 tested. Any comment?
>
> Thanks,
> Felix
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: analysis.txt
URL: <https://mail.openjdk.java.net/pipermail/hotspot-compiler-dev/attachments/20200305/064ec7ba/analysis.txt>
More information about the hotspot-compiler-dev
mailing list