RFR: 8292301: [REDO v2] C2 crash when allocating array of size too large

[Xin Liu]

On Fri, 26 Aug 2022 08:35:14 GMT, Roland Westrelin <roland at openjdk.org> wrote:

> On top of the redo, this fixed 2 bugs:
> 
> 8288184: the problem here is that the ValidLengthTest input of an
> AllocateArrayNode becomes a constant. The CatchNode would then change
> types if it was reprocessed but it's not. Custom logic is needed to
> enqueue the CatchNode when the ValidLengthTest input of an
> AllocateArrayNode changes. The CastII out of the AllocateArrayNode
> becomes top but the fallthrough path doesn't die. This happens with
> igvn in the case of the bug but could also happen with ccp. I fixed
> both in this patch.
> 
> 8291665: the code pattern for this is 2 AllocateArrayNodes out of loop
> with a shared ValidLengthTest input in a loop. When the loop is cloned
> that causes Phis to be added between the AllocateArrayNodes and the
> BoolNode of the ValidLengthTest inputs. Split if runs next and it
> doesn't expect the Phi at the ValidLengthTest inputs. The fix here is
> to clone the Bool/Cmp subgraph down on loop cloning. There's logic for
> that when the use of the bool is an If for instance so I simply added
> a special case to run that logic for an AllocateArrayNode use as
> well. Note that the test case I added fails reliably on 11 but not
> with the current jdk developement branch. AFAICT, the bug is there but
> something unrelated changed and a slightly different graph is built
> for the test case that prevents split if.

src/hotspot/share/opto/phaseX.cpp line 1855:

> 1853: // Same if true if the type of a ValidLengthTest input to an AllocateArrayNode changes
> 1854: void PhaseCCP::push_catch(Unique_Node_List& worklist, const Node* use) {
> 1855:   if (use->is_Call() || use->is_AllocateArray()) {

hi, Roland, 
I understand your intention here, but isn't AllocateArrayNode also a CallNode? 
My understanding is that use->is_Call() is true if use is an AllocationNode.

-------------

PR: https://git.openjdk.org/jdk/pull/10038