RFR: 8316414: C2: large byte array clone triggers "failed: malformed control flow" assertion failure on linux-x86 [v2]

Roland Westrelin roland at openjdk.org
Wed Sep 27 11:29:55 UTC 2023


> `GraphKit::new_array()` computes the maximum array length as:
> 
> 
> BasicType bt = ary_type->isa_aryptr()->elem()->array_element_basic_type();
> jint max = TypeAryPtr::max_array_length(bt);
> 
> 
> while `AllocateArrayNode::make_ideal_length()` calls
> `TypeAryPtr::narrow_size_type()` which in turn uses:
> 
> 
> jint max_hi = max_array_length(elem()->basic_type());
> 
> 
> That is, one uses `elem()->array_element_basic_type()` and the other
> `elem()->basic_type()`. As a result, the test that guarantees a new
> array allocation doesn't exceed the maximum array size and the
> `CastII` that narrows the length on the success path for the
> allocation don't use the same maximum array size values. The `CastII`
> one is lower and it is transformed to top. The fallthrough path should
> die but doesn't.

Roland Westrelin has updated the pull request incrementally with one additional commit since the last revision:

  copyright fix

-------------

Changes:
  - all: https://git.openjdk.org/jdk/pull/15914/files
  - new: https://git.openjdk.org/jdk/pull/15914/files/4f679361..75bbb65d

Webrevs:
 - full: https://webrevs.openjdk.org/?repo=jdk&pr=15914&range=01
 - incr: https://webrevs.openjdk.org/?repo=jdk&pr=15914&range=00-01

  Stats: 1 line in 1 file changed: 0 ins; 0 del; 1 mod
  Patch: https://git.openjdk.org/jdk/pull/15914.diff
  Fetch: git fetch https://git.openjdk.org/jdk.git pull/15914/head:pull/15914

PR: https://git.openjdk.org/jdk/pull/15914


More information about the hotspot-compiler-dev mailing list