RFR: 8291466: C2: assert(false) failed: infinite loop in PhaseIterGVN::transform_old with -XX:+StressIGVN

[Pengfei Li]

On Wed, 24 Aug 2022 13:06:41 GMT, Roland Westrelin <roland at openjdk.org> wrote:

>> Recently, an igvn infinite loop issue was reported. Git bisection shows
>> it appears after our JDK-8289996 patch. But after that patch is backed
>> out, we find similar test still fails. We have attached a jtreg case to
>> reproduce this issue.
>> 
>> The ideal graph of the problematic method has a `MulINode` multiplying a
>> `PhiNode` by a `ConINode`. For better optimizations, `MulINode::Ideal()`
>> moves the constant input to the right hand side. And `Ideal()` function
>> in its parent class `MulNode` has the similar logic. In some code paths,
>> `MulINode::Ideal()` calls `MulNode::Ideal()`. The problem here is that,
>> `MulINode` and `MulNode` use different ways to check constant. One calls
>> `type->singleton()` and the other calls `node->find_int_con(val)` which
>> accepts constant in `PhiNode`. So in some corner cases where a `PhiNode`
>> can be evaluated to a constant, the two inputs of the `MulNode` will be
>> swapped back and forth in `Ideal()` calls. It eventually causes the igvn
>> infinite loop issue.
>> 
>> This patch removes the `swap_edges()` logic in `MulINode` and `MulLNode`
>> because it's enough to do this by calling `MulNode::Ideal()`. We also do
>> some code cleanup in this patch as we have done in JDK-8289996.
>> 
>> Tested hotspot::hotspot_all_no_apps, jdk::tier1~3 and langtools::tier1.
>
> src/hotspot/share/opto/mulnode.cpp line 252:
> 
>> 250: 
>> 251:   // Now we have a constant Node on the right and the constant in con
>> 252:   if (con == 0) return NULL;   // By zero is handled by Value call
> 
> Value() runs after Ideal so why wouldn't we have con == 0 here?

This Ideal function is returned in `if ((con = in(2)->find_int_con(0)) == 0)` block above if we have `con == 0`. So this line is actually unreachable.

-------------

PR: https://git.openjdk.org/jdk/pull/9820