RFR: 8303279: C2 Compiler crash (triggered by Kotlin 1.8.10) [v2]

[Volker Simonis]

On Tue, 27 Jun 2023 12:49:36 GMT, Volker Simonis <simonis at openjdk.org> wrote:

>> This is a problem probably introduced by [JDK-8238691](https://bugs.openjdk.org/browse/JDK-8238691). It could reproduce it with JDK 17, 18 and 21 and results in the following crash (see [JBS-issue](https://bugs.openjdk.org/browse/JDK-8303279) for more details):
>> 
>> 
>> # Internal Error (/priv/simonisv/OpenJDK/Git/jdk/src/hotspot/share/opto/type.hpp:2059), pid=1152816, tid=1154124
>> # assert(_base >= OopPtr && _base <= AryPtr) failed: Not a Java pointer
>> #
>> # JRE version: OpenJDK Runtime Environment (21.0) (slowdebug build 21-internal-adhoc.simonisv.jdk)
>> ...
>> Current CompileTask:
>> C2: 91009 8214 ! 4 io.grpc.kotlin.ServerCalls$serverCallListener$requests$1::invokeSuspend (285 bytes)
>> 
>> Stack: [0x00007fff1306b000,0x00007fff1316c000], sp=0x00007fff13166fe0, free space=1007k
>> Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
>> V [libjvm.so+0x61d636] Type::is_oopptr() const+0x4e (type.hpp:2059)
>> V [libjvm.so+0x14cee55] SubTypeCheckNode::sub(Type const*, Type const*) const+0x53 (subtypenode.cpp:37)
>> V [libjvm.so+0x14c66b0] SubNode::Value(PhaseGVN*) const+0xa6 (subnode.cpp:107)
>> V [libjvm.so+0xcdacb3] split_if(IfNode*, PhaseIterGVN*)+0x2ce (ifnode.cpp:111)
>> V [libjvm.so+0xce044c] IfNode::Ideal_common(PhaseGVN*, bool)+0x128 (ifnode.cpp:1438)
>> V [libjvm.so+0xce0496] IfNode::Ideal(PhaseGVN*, bool)+0x30 (ifnode.cpp:1448)
>> V [libjvm.so+0x1298244] PhaseGVN::apply_ideal(Node*, bool)+0x70 (phaseX.cpp:667)
>> V [libjvm.so+0x129a0fd] PhaseIterGVN::transform_old(Node*)+0x12d (phaseX.cpp:1196)
>> V [libjvm.so+0x12998df] PhaseIterGVN::optimize()+0x16b (phaseX.cpp:1045)
>> V [libjvm.so+0x93f89e] Compile::Optimize()+0xce0 (compile.cpp:2378)
>> V [libjvm.so+0x9385fa] Compile::Compile(ciEnv*, ciMethod*, int, Options, DirectiveSet*)+0x16ca (compile.cpp:842)
>> V [libjvm.so+0x806ab4] C2Compiler::compile_method(ciEnv*, ciMethod*, int, bool, DirectiveSet*)+0x1a0 (c2compiler.cpp:118)
>> V [libjvm.so+0x958bc8] CompileBroker::invoke_compiler_on_method(CompileTask*)+0xa04 (compileBroker.cpp:2265)
>> V [libjvm.so+0x9576fa] CompileBroker::compiler_thread_loop()+0x462 (compileBroker.cpp:1944)
>> V [libjvm.so+0x97b14a] CompilerThread::thread_entry(JavaThread*, JavaThread*)+0x84 (compilerThread.cpp:58)
>> V [libjvm.so+0xd434ce] JavaThread::thread_main_inner()+0x15c (javaThread.cpp:719)
>> V [libjvm.so+0xd43368] JavaThread::run()+0x258 (javaThread.cpp:704)
>> V [libjvm.so+0x15481ea] Thread::call_run()+0x1a8 (thread.cpp:217)
>> V [libjvm.so+0x1230036] thread_na...
>
> Volker Simonis has updated the pull request incrementally with one additional commit since the last revision:
> 
>   Added Roland's new test

> FWIW, I propose an alternate fix here. [master...rwestrel:jdk:JDK-8303279](https://github.com/openjdk/jdk/compare/master...rwestrel:jdk:JDK-8303279) Seeing null or a nullable value at a `SubTypeCheck` could be a bug as the expectation is that inputs are null checked and the implementation of `SubTypeCheck` would crash with a null input. So I added an assert to `SubTypeCheckNode::sub` to catch a nullable input. The assert fires with the test because split if runs with a non yet fully collapsed dead path. So I tweak split if so it's delayed until the path is collapsed. When running testing I found that the assert would fire in other cases because of values known to be non null be not marked as such. The end result is a bigger patch.

Thanks @rwestrel. I'm fine with your patch. Do you want to take JDK-8303279 and propose your fix as PR? I will then close mine.

-------------

PR Comment: https://git.openjdk.org/jdk/pull/14600#issuecomment-1609565121