RFR: 8316414: C2: large byte array clone triggers "failed: malformed control flow" assertion failure on linux-x86 [v2]
Roland Westrelin
roland at openjdk.org
Wed Sep 27 11:29:55 UTC 2023
> `GraphKit::new_array()` computes the maximum array length as:
>
>
> BasicType bt = ary_type->isa_aryptr()->elem()->array_element_basic_type();
> jint max = TypeAryPtr::max_array_length(bt);
>
>
> while `AllocateArrayNode::make_ideal_length()` calls
> `TypeAryPtr::narrow_size_type()` which in turn uses:
>
>
> jint max_hi = max_array_length(elem()->basic_type());
>
>
> That is, one uses `elem()->array_element_basic_type()` and the other
> `elem()->basic_type()`. As a result, the test that guarantees a new
> array allocation doesn't exceed the maximum array size and the
> `CastII` that narrows the length on the success path for the
> allocation don't use the same maximum array size values. The `CastII`
> one is lower and it is transformed to top. The fallthrough path should
> die but doesn't.
Roland Westrelin has updated the pull request incrementally with one additional commit since the last revision:
copyright fix
-------------
Changes:
- all: https://git.openjdk.org/jdk/pull/15914/files
- new: https://git.openjdk.org/jdk/pull/15914/files/4f679361..75bbb65d
Webrevs:
- full: https://webrevs.openjdk.org/?repo=jdk&pr=15914&range=01
- incr: https://webrevs.openjdk.org/?repo=jdk&pr=15914&range=00-01
Stats: 1 line in 1 file changed: 0 ins; 0 del; 1 mod
Patch: https://git.openjdk.org/jdk/pull/15914.diff
Fetch: git fetch https://git.openjdk.org/jdk.git pull/15914/head:pull/15914
PR: https://git.openjdk.org/jdk/pull/15914
More information about the hotspot-compiler-dev
mailing list