RFR: 8331717: C2: Crash with SIGFPE

theoweidmannoracle duke at openjdk.org
Wed Dec 11 14:19:40 UTC 2024


Fixes a bug in loop predication where not strictly invariant tests involving divisions or modulo are pulled out of the loop.

The bug can be seen in this code:


public class Reduced {
    static int iArr[] = new int[100];

    public static void main(String[] strArr) {
        for (int i = 0; i < 10000; i++) {
            test();
        }
    }

    static void test() {
        int i1 = 0;

        for (int i4 : iArr) {
            i4 = i1;
            try {
                iArr[0] = 1 / i4;
                i4 = iArr[2 / i4]; // Source of the crash
            } catch (ArithmeticException a_e) {
            }
        }
    }
}


The crucial element is the division `2 / i4`. Since it is used to access an array, it is the input to a range check. See node 230:
<img width="699" alt="Screenshot 2024-12-11 at 15 14 47" src="https://github.com/user-attachments/assets/0b2ed978-7135-4a7e-bd10-25c0ffe7a9bb" />

Loop predication will try to pull this range check together with its input, the division, before the `for` loop. Due to a bug in Invariance::compute_invariance loop predication is allowed to do so, which results in the division being pulled out without its non-zero check. 322 is a clone of 230 placed before the loop head without any zero check for the divisor:

<img width="798" alt="Screenshot 2024-12-11 at 15 11 48" src="https://github.com/user-attachments/assets/9d4911cc-9967-4b7a-9969-98e01a55cd0d" />

To fix this, Invariance::compute_invariance must check that the node not only `depends_only_on_test()` but also that it has `no_dependent_zero_check(n)`.

Similar past bug, which introduced `no_dependent_zero_check`: https://github.com/openjdk/jdk16/pull/9

-------------

Commit messages:
 - Fix typo
 - Update TestLoopPredicationDivZeroCheck2.java
 - Fix copyright
 - Describe tests
 - Add tests
 - try to fix

Changes: https://git.openjdk.org/jdk/pull/22666/files
  Webrev: https://webrevs.openjdk.org/?repo=jdk&pr=22666&range=00
  Issue: https://bugs.openjdk.org/browse/JDK-8331717
  Stats: 124 lines in 3 files changed: 123 ins; 0 del; 1 mod
  Patch: https://git.openjdk.org/jdk/pull/22666.diff
  Fetch: git fetch https://git.openjdk.org/jdk.git pull/22666/head:pull/22666

PR: https://git.openjdk.org/jdk/pull/22666


More information about the hotspot-compiler-dev mailing list