RFR(S): 8244407: JVM crashes after transformation in C2 IdealLoopTree::split_fall_in

Yangfei (Felix) felix.yang at huawei.com
Wed May 6 01:32:12 UTC 2020


Hi, 

  Please help review this patch fixing a C2 crash issue. 
  Bug: https://bugs.openjdk.java.net/browse/JDK-8244407 
  Webrev: http://cr.openjdk.java.net/~fyang/8244407/webrev.00 

  After the fix for JDK-8240576, irreducible loop tree might be structurally changed by split_fall_in() in IdealLoopTree::beautify_loops.
  But loop tree is not rebuilt after that. Take the reported test case for example, irreducible loop tree looks like:

1: Loop: N649/N644

Loop: N649/N644  IRREDUCIBLE    <-- this
  Loop: N649/N797  sfpts={ 683 }

With the fix for JDK-8240576,we won't do merge_many_backedges in IdealLoopTree::beautify_loops for this irreducible loop tree.

  if( _head->req() > 3 && !_irreducible) {
    // Merge the many backedges into a single backedge but leave
    // the hottest backedge as separate edge for the following peel.
    merge_many_backedges( phase );
    result = true;
  }

N660                 N644         N797
  |                             |             |
  |                             |             |
  |                             v             |
  |             +---+---+             |
  +-----> +  N649  + <-----+
                 +--------+

 649    Region  ===  649  660  797  644  [[ .... ]]  !jvms: Test::testMethod @ bci:543

Then we come to the children:

   // Now recursively beautify nested loops
   if( _child ) result |= _child->beautify_loops( phase );

2: Loop: N649/N797

 Loop: N649/N644  IRREDUCIBLE
  Loop: N649/N797  sfpts={ 683 }    <-- this

After spilt_fall_in(),N660 and N644 are merged.

    if( fall_in_cnt > 1 )         // Need a loop landing pad to merge fall-ins
      split_fall_in( phase, fall_in_cnt );

N660                               N644
  |                                          +
  |                                          |
  |                                          |
  |          +---------+            |
  +---->+  N946   +<-----+
              +----+---+
             |                                      N797
             |                                          |
             |                                          |
             |                                          |
             |           +--------+            |
             +----> +  N649  + <-----+
                          +--------+

Loop tree is now structurally changed into:

  Loop: N946/N644  IRREDUCIBLE
    Loop: N649/N797  sfpts={ 683 }

But local variable 'result' in IdealLoopTree::beautify_loops hasn't got a chance to be set to true since _head->req() is not bigger than 3 after split_fall_in.
Then C2 won't rebuild loop tree after IdealLoopTree::beautify_loops, which further leads to the crash.
Instead of adding extra checking for loop tree structure changes, proposed fix sets 'result' to true when we meet irreducible loop with multiple backedges.
This should be safer and simpler (thus good for JIT compile time).
Tiered 1-3 tested on x86-64 and aarch64 linux platform.  Comments?

Thanks,
Felix


More information about the hotspot-compiler-dev mailing list