RFR: 8373525: C2: assert(_base == Long) failed: Not a Long

[Manuel Hässig]

On Fri, 19 Dec 2025 10:22:58 GMT, Damon Fenacci <dfenacci at openjdk.org> wrote:

> # Issue
> Olivier's fuzzer found a test that makes C2 crash while running the optimization that collapses the addition with overflow-protection (`fold_subI_no_underflow_pattern`).
> 
> # Causes
> The crash happens because during `fold_subI_no_underflow_pattern` the first input of the `AddL` node (see comment below) becomes top.
> https://github.com/openjdk/jdk/blob/82b04f01bc99e8155518b8b8600d180981a42fc5/src/hotspot/share/opto/addnode.cpp#L1525-L1533
> 
> This happens because of a whole `IfFalse` subgraph that dies and nodes are being removed. `AddL` is not removed immediately as it has another input which is still alive but it is put in the IGVN worklist instead.
> 
> <img width="463" height="239" alt="image" src="https://github.com/user-attachments/assets/bce0e4b0-b823-473d-91de-2bb048841e65" />
> 
> Unfortunately the `fold_subI_no_underflow_pattern` optimization runs before the next GVN pass and triggers the assert.
> 
> # Fix
> `fold_subI_no_underflow_pattern` should actually take into account that we could have the graph in such a state and that `x` could be top. So, the sensible fix is not to presume `x` to be of type long and bailout if it is not.
> 
> # Testing
> Tier 1-3+
> (also checked for new regression test failure before the change)

Thank you for fixing this, @dafedafe. The fix looks good. I only have some minor comments on the test.

test/hotspot/jtreg/compiler/loopopts/TestValidTypeInOverflowProtection.java line 28:

> 26:  * @bug 8373525
> 27:  * @summary Test for the check of a valid type (long) for the input variable of overflow protection
> 28:  * @requires vm.debug == true & vm.compiler2.enabled

Is this requires needed? I guess it is needed to reproduce the failure, but does this test fail on a product build? Running it in more scenarios should provide for some more coverage.

test/hotspot/jtreg/compiler/loopopts/TestValidTypeInOverflowProtection.java line 31:

> 29:  * @run main/othervm -Xbatch -XX:-TieredCompilation -XX:CompileCommand=compileonly,compiler.loopopts.TestValidTypeInOverflowProtection::test
> 30:  *                   compiler.loopopts.TestValidTypeInOverflowProtection
> 31:  * @run driver compiler.loopopts.TestValidTypeInOverflowProtection

Now that we have it, we should use the fancy jtreg variable for the test class to fend off the typos.
Suggestion:

 *                   ${test.main.class}
 * @run driver ${test.main.class}

-------------

Changes requested by mhaessig (Committer).

PR Review: https://git.openjdk.org/jdk/pull/28920#pullrequestreview-3598854842
PR Review Comment: https://git.openjdk.org/jdk/pull/28920#discussion_r2635310142
PR Review Comment: https://git.openjdk.org/jdk/pull/28920#discussion_r2635303964