RFR(S): 8240576: JVM crashes after transformation in C2 IdealLoopTree::merge_many_backedges

Yangfei (Felix) felix.yang at huawei.com
Fri Mar 6 01:07:44 UTC 2020


Webrev: http://cr.openjdk.java.net/~fyang/8240576/webrev.00/ 

Tiered 1-3 tested. 

This is also pushed to the submit repo for extra testing.  
The result looks good: 
Job: mach5-one-fyang-JDK-8240576-20200305-1721-9207377
BuildId: 2020-03-05-1720270.felix.yang.source
No failed tests
Tasks Summary
•	PASSED: 79
•	FAILED: 0
•	NOTHING_TO_RUN: 0
•	HARNESS_ERROR: 0
•	NA: 0
•	EXECUTED_WITH_FAILURE: 0
•	KILLED: 0
•	UNABLE_TO_RUN: 0


> -----Original Message-----
> From: Yangfei (Felix)
> Sent: Thursday, March 5, 2020 5:00 PM
> To: 'hotspot-compiler-dev at openjdk.java.net'
> <hotspot-compiler-dev at openjdk.java.net>
> Subject: RE: RFR(S): 8240576: JVM crashes after transformation in C2
> IdealLoopTree::merge_many_backedges
> 
> Hi,
> 
> Looks like the formatting in the previous mail is bad. :- (
> 
> Attached please find the analysis file.  It should have a better display when
> opened in a VI editor.
> 
> Thanks,
> Felix
> 
> > -----Original Message-----
> > From: Yangfei (Felix)
> > Sent: Thursday, March 5, 2020 4:52 PM
> > To: hotspot-compiler-dev at openjdk.java.net
> > Subject: RFR(S): 8240576: JVM crashes after transformation in C2
> > IdealLoopTree::merge_many_backedges
> >
> > Hi,
> >
> >   Please help review this patch fixing a C2 bug.
> >   Bug: https://bugs.openjdk.java.net/browse/JDK-8240576
> >   Will prepare a webrev adding the test case later.
> >
> >   There is an ordinary nested loop in the test case.
> >   When entrybci = -1. It has 5 reducible loop.
> >   Normal control flow looks like:
> >
> >           +------+
> >           |0:Root |
> >           +------+
> >             |
> >             |
> >             v
> >        +---------+
> >  <-----  |1:Region1|<-----------------+
> >        |if(i<100)|<---------+     |
> >        +---------+       |     |
> >           |  ^       |     |
> >           |  |       |      |
> >           v  |       |     |
> >       +-----------+      |      |
> >       |2:if(mF!=0)|    |      |
> >       +-----------+      |      |
> >            |         |     |
> >            |         |     |
> >            v         |     |
> >        +---------+       |     | try-catch
> >        |3:Region2|    |      |
> >        |if(j<101)|----------+      |
> >        +---------+              |
> >           |  ^              |
> >           |  |              |
> >           v  |              |
> >        +---------+              |
> >        |4:Region3|           |
> >        |if(k<102)|             |
> >        +---------+               |
> >           |  ^               |
> >           |  |                |
> >           v  |                |
> > +-----------------------------+           |
> > |5:int mI=new Interger(0x1234)|-----+
> > +-----------------------------+
> >
> > Current CompileTask:
> > C2:  13694  832 % !b        Test::testMethod @ 37 (83 bytes)
> >
> > Problem triggered during the OSR compilation.
> > It has 3 reducible loop and 1 irreducible loop.
> > OSR control flow looks like:
> >
> >                                            +------+
> >                                            |0:Root|
> >                                            +---+--+
> >                                               |
> >                                               |
> >                                               v
> > +-----------------------------+                       +----+----+
> > |5:int mI=new Interger(0x1234)|    <---------    |4:Region3|
> > |                             |--------->    |if(k<102)|
> > +------------+----------------+                      +--+--+---+
> >              |                              |  ^
> >              |                              |  |
> >              |                              v  |
> >              |                           +---------+
> >              |                           |3:Region2|<-----------+
> >              |  try-catch                  |if(j<101)|         |
> >              |                           +---------+          |
> >              |                                |           |
> >              |                                |           |
> >              |                                v           |
> >              |                           +---------+          |
> >              +-------------------------->           |1:Region1|------>    |
> >                                          |if(i<100)|         |
> >                                          +---------+          |
> >                                             |  ^          |
> >                                             |  |          |
> >                                             v  |          |
> >                                         +-----------+         |
> >                                         |2:if(mF!=0)|-----------+
> >                                         +-----------+
> >
> > In the first beautify_loops, something went wrong when c2 does
> > merge_many_backedges.
> >
> > 2090   // If I am a shared header (multiple backedges), peel off the many
> > 2091   // backedges into a private merge point and use the merge point as
> > 2092   // the one true backedge.
> > 2093   if( _head->req() > 3) {
> > 2094     // Merge the many backedges into a single backedge but leave
> > 2095     // the hottest backedge as separate edge for the following peel.
> > 2096     merge_many_backedges( phase );
> > 2097     result = true;
> > 2098   }
> >
> > Subgraph before merge_many_backedges:
> >
> > |                              |
> > |                              |
> > |                              v
> > |                           +---------+
> > |  try-catch                 |3:Region2|<-----------+
> > |                           |if(j<101)|        |
> > |                           +---------+          |
> > |                                |           |
> > |                                |           |
> > |                                v            |
> > |                            +---------+         |
> > +-------------------------->           |1:Region1|  ----->  |
> >                             |if(i<100)|         |
> >                             +---------+          |
> >                                |  ^          |
> >                                |  |          |
> >                                v  |          |
> >                             +-----------+         |
> >                             |2:if(mF!=0)|-----------+
> >                             +-----------+
> >
> >
> > Before line 2096, IdealLoopTree looks like:
> >
> > IdealLoopTree:
> > N1/N3 irreducible
> >   N1/N2 reducible
> >
> >
> > Subgraph after merge_many_backedges:
> >
> > |                              |
> > |                              |
> > |                              v
> > |                           +--+------+
> > |  try+catch                 |3:Region2|<-----------+
> > |                           |if(j<101)|         |
> > |                           +---------+           |
> > |                                |             |
> > |                                |             |
> > |                                v             |
> > |                            +----+----+          |
> > +-------------------------->           |1:Region1|----->     |
> >                             |if(i<100)|           |
> >                              ++-------++          |
> >                              |       ^         |
> >                              |       |         |
> >                              |       |         |
> >                              |     +---------+     |
> >                              |    |6:Region3|   |
> >                              |     +---------+     |
> >                              |       ^         |
> >                              |       |         |
> >                              v       |         |
> >                              +-----------+         |
> >                              |2:if(mF!=0)| -----------+
> >                              +-----------+
> >
> > After line 2096, IdealLoopTree looks like:
> >
> > IdealLoopTree:
> > N1/N6 irreducible
> >    N1/N3 reducible
> >
> > The overall structure of the loop remains the same, but its
> > irreducible attributes has been modified incorrectly, which further leads to
> the vm crash.
> > Proposed fix prevents doing merge_many_backedges when IdealLoopTree is
> > irreducible.
> >
> > diff -r 67cc6f3948e3 src/hotspot/share/opto/loopnode.cpp
> > --- a/src/hotspot/share/opto/loopnode.cpp       Wed Mar 04 15:34:53
> 2020
> > -0800
> > +++ b/src/hotspot/share/opto/loopnode.cpp       Thu Mar 05 09:32:57
> 2020
> > +0800
> > @@ -2091,7 +2091,7 @@
> >    // If I am a shared header (multiple backedges), peel off the many
> >    // backedges into a private merge point and use the merge point as
> >    // the one true backedge.
> > -  if( _head->req() > 3 ) {
> > +  if (_head->req() > 3 && !_irreducible) {
> >      // Merge the many backedges into a single backedge but leave
> >      // the hottest backedge as separate edge for the following peel.
> >      merge_many_backedges( phase );
> >
> >   Tiered 1-3 tested.  Any comment?
> >
> > Thanks,
> > Felix


More information about the hotspot-compiler-dev mailing list