RFR: 8320308: C2 compilation crashes in LibraryCallKit::inline_unsafe_access

[Roland Westrelin]

On Tue, 3 Sep 2024 09:31:18 GMT, Tobias Holenstein <tholenstein at openjdk.org> wrote:

> `base` is `147 CheckCastPP === 136 71 [[ 150 149 ]] #java/lang/Object * (speculative=byte[int:>=0] (java/lang/Cloneable,java/io/Serializable):NotNull:exact * (inline_depth=2)) Oop:java/lang/Object * (speculative=byte[int:>=0] (java/lang/Cloneable,java/io/Serializable):NotNull:exact * (inline_depth=2)) !jvms: Test::helperSmall @ bci:11 (line 23) Test::accessSmallArray @ bci:7 (line 29) Test::test2 @ bci:2 (line 38)` before
> 
> https://github.com/openjdk/jdk/blob/34c6e0deac567c0f4ed08aa2824671551d843e95/src/hotspot/share/opto/library_call.cpp#L2090
> 
> and `1 Con === 0 [[ ]] #top` after.
> Then `base` is top when we call `basic_plus_adr(base, offset)` right after.

I think Vladimir's question is: how can `null_check_oop()` return `top`? AFAIU, it creates a `CastPP` with 147 as input and that `CastPP` is transformed to top. How does that happen? What are the steps in the call to `_gvn.transform( cast );` that lead to a result of `top`.

-------------

PR Comment: https://git.openjdk.org/jdk/pull/20033#issuecomment-2331789415