RFR: 8274130: C2: MulNode::Ideal chained transformations may act on wrong nodes

Aleksey Shipilev shade at openjdk.java.net
Wed Sep 22 10:21:43 UTC 2021


I was puzzled by it when fixing JDK-8274060. It looks that new optimizations added by [JDK-8273454](https://bugs.openjdk.java.net/browse/JDK-8273454) and [JDK-8263006](https://bugs.openjdk.java.net/browse/JDK-8263006) rewire `in(1)` and `in(2)` in `MulNode::Ideal`, which means the chained transformations should see them? Yet, both inputs and their `Type`-s are cached locally and not refreshed. I have not seen failures due to this yet, but it looks that the current code is subtly incorrect because of this. 

I thought about doing `return this` instead of `progress = true`, so that we leave `MulNode::Ideal` once we hit any transform and hope to return back, but I wondered if that would expose us to different graph shapes in-between successive `MulNode::Ideal` calls, which might have other unintended consequences. Therefore, I opted to a more conservative patch.

Additional testing:
 - [x] `compiler/` tests
 - [ ] `tier1` tests
 - [ ] Fuzzer tests

-------------

Commit messages:
 - Fix

Changes: https://git.openjdk.java.net/jdk/pull/5631/files
 Webrev: https://webrevs.openjdk.java.net/?repo=jdk&pr=5631&range=00
  Issue: https://bugs.openjdk.java.net/browse/JDK-8274130
  Stats: 11 lines in 1 file changed: 7 ins; 2 del; 2 mod
  Patch: https://git.openjdk.java.net/jdk/pull/5631.diff
  Fetch: git fetch https://git.openjdk.java.net/jdk pull/5631/head:pull/5631

PR: https://git.openjdk.java.net/jdk/pull/5631


More information about the hotspot-compiler-dev mailing list