RFR: 8362117: C2: compiler/stringopts/TestStackedConcatsAppendUncommonTrap.java fails with a wrong result due to invalidated liveness assumptions for data phis

[Emanuel Peter]

On Mon, 1 Sep 2025 07:04:25 GMT, Daniel Skantz <dskantz at openjdk.org> wrote:

> This PR addresses a wrong compilation during string optimizations.
> 
> During stacked string concatenation of two StringBuilder links SB1 and SB2, the pattern "append -> Phi -> Region -> (True, False) -> If -> Bool -> CmpP -> Proj (Result) -> toString" may be observed, where toString is the end of SB1, and the simple diamond is part of SB2.
> 
> After JDK-8291775, the Bool test to the diamond If is set to a constant zero to allow for folding the simple diamond away during IGVN, while not letting the top() value from the result projection of SB1 propagate through the graph too quickly. The assumption was that any data Phi of the Region would go away during PhaseRemoveUseless as they are no longer live -- I think that in the case of JDK-8291775, the user of phi was the constructor of SB2. However, in the attached test case, the Phi stays live as it's a parameter (input to an append) of SB2 and will be used during the transformation in `copy_string`. When the diamond region is later folded, the Phi's user picks up the wrong input corresponding to the false branch.
> 
> The proposed solution is to disable the stacked concatenation optimization for this specific pattern. This might be pragmatic as it's an edge case and there's already a bug tail: JDK-8271341-> JDK-8291775 -> JDK-8362117.
> 
> Testing: T1-3 (aed5952).
> 
> Extra testing: ran T1-3 on Linux with an instrumented build and verified that the pattern I am excluding in this PR is not seen during any other compilation than that of the proposed regression test.

src/hotspot/share/opto/stringopts.cpp line 1078:

> 1076:         assert(ptr->in(1)->in(0)->in(1)->is_Bool(), "unexpected if shape");
> 1077:         Node* v1 = ptr->in(1)->in(0)->in(1)->in(1)->in(1);
> 1078:         Node* v2 = ptr->in(1)->in(0)->in(1)->in(1)->in(2);

You may want to use some intermediate results and give them names.
For example:
`Node* iff = ptr->in(1)->in(0)`
You seem to make an assumption that the input of the bool is a cmp, right? Did you check that? Or is it somehow guaranteed? What if in some edge-case of an edge-case it is something else that has only one input? Could that happen?

-------------

PR Review Comment: https://git.openjdk.org/jdk/pull/27028#discussion_r2314106612