RFR: 8351889: C2 crash: assertion failed: Base pointers must match (addp 344) [v2]

[Emanuel Peter]

On Thu, 2 Oct 2025 09:29:34 GMT, Roland Westrelin <roland at openjdk.org> wrote:

>> What if we just relax the assert?  I failed to figure out what this assert is protecting us from by looking at the code.  So what happens in a product build or when this assert is commented out?
>
>> What if we just relax the assert? I failed to figure out what this assert is protecting us from by looking at the code. So what happens in a product build or when this assert is commented out?
> 
> For this particular test case, nothing. The assert is right before the cast nodes are removed, anyway. Once they are removed, the `AddP` in the chain all have the same base input.
> The risk, I think, is if some code that transforms a chain of `AddP`s (some time before the assert) wrongly assume they all have the same base.  It's also easier to write such a transformation if it's an invariant that a chain of `AddP`s have the same base (it's one less thing to worry about).

@rwestrel I'm stepping through the reproducer myself now, and visualizing what happens.

After Parsing, before Optimize:
<img width="1796" height="905" alt="image" src="https://github.com/user-attachments/assets/0c0932e8-0697-40bb-9c37-d9a280222095" />

After first loopopts, before its IGVN. We see that there was some duplication of the loop. Somehow, this introduces a second `CastPP`, and we get an orange and a yellow address subgraph.
<img width="1795" height="910" alt="image" src="https://github.com/user-attachments/assets/5178d36a-357d-4a1b-81b4-649e496512ff" />

Now, lots of interesting things happend in the loopopts cleanup (IGVN).
1. The yellow graph pushes the `488 Phi` through the `AddP`s.
<img width="1801" height="912" alt="image" src="https://github.com/user-attachments/assets/aabc5f68-27fe-4f21-9111-15e804276a78" />

2. Then `371 Phi` is pushed through its `AddP`s.
<img width="1799" height="906" alt="image" src="https://github.com/user-attachments/assets/2a385dd1-0a61-4aa3-b878-6ca764e99446" />

This is an interesting state, because now we have a new `527 Phi` that merges the base (just the two `CastPP`), and the other new `528 Phi` merges the addresses.

TODO continue

-------------

PR Comment: https://git.openjdk.org/jdk/pull/25386#issuecomment-3528421673