RFR: 8261812: C2 compilation fails with assert(!had_error) failed: bad dominance
Roland Westrelin
roland at openjdk.java.net
Mon Mar 1 07:57:12 UTC 2021
In the testByte() test case, byteField is assigned int values that
don't fit in a byte.
obj.byteField = (byte)(1 << i);
At parse time, c2 expands this to (in pseudo code):
int v = (1 << i);
obj.byteField = (v << 24) >> 24;
next:
StoreBNode::Ideal() runs and StoreNode::Ideal_sign_extended_input()
causes this to become:
obj.byteField = (1 << i);
i is then constant folded to 9:
obj.byteField = 512;
obj doesn't escape and is scalarized. The value of the byteField needs
to be recorded in the debug info. Because there are 2 such a store, a
Phi is created:
(Phi 512 1024)
The Phi is created with type TypeInt::BYTE. Because that doesn't
overlap with the input values, the Phi is transformed to top. The test
case then triggers a deoptimization and a crash occurs in the
deoptimization code.
The failure of the bug report is not a crash during deoptimization but
a c2 crash. The root cause is the same but in that case a chain of Phi
is involved and when one becomes top, it causes an uncommon trap to
have an input that doesn't dominate the uncommon trap.
I noticed LoadBNode::Ideal() re-inserts the 2 shifts when it returns a
value from a Store. I propose the same fix here in the allocation
elimination code.
Same problem applies to short and char. They are covered by the fix. I
also included boolean even though I don't see how to trigger the
failure with it.
-------------
Commit messages:
- test & fix
Changes: https://git.openjdk.java.net/jdk/pull/2774/files
Webrev: https://webrevs.openjdk.java.net/?repo=jdk&pr=2774&range=00
Issue: https://bugs.openjdk.java.net/browse/JDK-8261812
Stats: 172 lines in 6 files changed: 149 ins; 2 del; 21 mod
Patch: https://git.openjdk.java.net/jdk/pull/2774.diff
Fetch: git fetch https://git.openjdk.java.net/jdk pull/2774/head:pull/2774
PR: https://git.openjdk.java.net/jdk/pull/2774
More information about the hotspot-compiler-dev
mailing list