8244407: JVM crashes after transformation in C2 IdealLoopTree::split_fall_in jdk8u262-b05 jdk8u272-b00

Mon, 25 May 2020 14:24:27 +0800

author
fyang
date
Mon, 25 May 2020 14:24:27 +0800
changeset 9922
f7691a80458c
parent 9921
9cbafea410f5
child 9923
de6565b66f94

8244407: JVM crashes after transformation in C2 IdealLoopTree::split_fall_in
Reviewed-by: thartmann, kvn, andrew
Contributed-by: zhouyong44@huawei.com

src/share/vm/opto/loopnode.cpp file | annotate | diff | comparison | revisions
test/compiler/loopopts/TestBeautifyLoops_2.java file | annotate | diff | comparison | revisions
     1.1 --- a/src/share/vm/opto/loopnode.cpp	Mon May 25 07:03:06 2020 +0100
     1.2 +++ b/src/share/vm/opto/loopnode.cpp	Mon May 25 14:24:27 2020 +0800
     1.3 @@ -1,5 +1,5 @@
     1.4  /*
     1.5 - * Copyright (c) 1998, 2017, Oracle and/or its affiliates. All rights reserved.
     1.6 + * Copyright (c) 1998, 2020, Oracle and/or its affiliates. All rights reserved.
     1.7   * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
     1.8   *
     1.9   * This code is free software; you can redistribute it and/or modify it
    1.10 @@ -1538,10 +1538,18 @@
    1.11    // If I am a shared header (multiple backedges), peel off the many
    1.12    // backedges into a private merge point and use the merge point as
    1.13    // the one true backedge.
    1.14 -  if (_head->req() > 3 && !_irreducible) {
    1.15 +  if (_head->req() > 3) {
    1.16      // Merge the many backedges into a single backedge but leave
    1.17      // the hottest backedge as separate edge for the following peel.
    1.18 -    merge_many_backedges( phase );
    1.19 +    if (!_irreducible) {
    1.20 +      merge_many_backedges( phase );
    1.21 +    }
    1.22 +
    1.23 +    // When recursively beautify my children, split_fall_in can change
    1.24 +    // loop tree structure when I am an irreducible loop. Then the head
    1.25 +    // of my children has a req() not bigger than 3. Here we need to set
    1.26 +    // result to true to catch that case in order to tell the caller to
    1.27 +    // rebuild loop tree. See issue JDK-8244407 for details.
    1.28      result = true;
    1.29    }
    1.30  
     2.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     2.2 +++ b/test/compiler/loopopts/TestBeautifyLoops_2.java	Mon May 25 14:24:27 2020 +0800
     2.3 @@ -0,0 +1,81 @@
     2.4 +/*
     2.5 + * Copyright (c) 2020, Huawei Technologies Co. Ltd. All rights reserved.
     2.6 + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
     2.7 + *
     2.8 + * This code is free software; you can redistribute it and/or modify it
     2.9 + * under the terms of the GNU General Public License version 2 only, as
    2.10 + * published by the Free Software Foundation.
    2.11 + *
    2.12 + * This code is distributed in the hope that it will be useful, but WITHOUT
    2.13 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    2.14 + * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
    2.15 + * version 2 for more details (a copy is included in the LICENSE file that
    2.16 + * accompanied this code).
    2.17 + *
    2.18 + * You should have received a copy of the GNU General Public License version
    2.19 + * 2 along with this work; if not, write to the Free Software Foundation,
    2.20 + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
    2.21 + *
    2.22 + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
    2.23 + * or visit www.oracle.com if you need additional information or have any
    2.24 + * questions.
    2.25 + */
    2.26 +
    2.27 +/**
    2.28 + * @test
    2.29 + * @bug 8244407
    2.30 + * @summary JVM crashes after transformation in C2 IdealLoopTree::split_fall_in
    2.31 + *
    2.32 + * @run main/othervm -Xcomp -XX:-BackgroundCompilation
    2.33 + *      -XX:CompileCommand=compileonly,compiler.loopopts.TestBeautifyLoops_2::testMethod
    2.34 + *      compiler.loopopts.TestBeautifyLoops_2
    2.35 + */
    2.36 +
    2.37 +package compiler.loopopts;
    2.38 +
    2.39 +public class TestBeautifyLoops_2 {
    2.40 +
    2.41 +    private class X {
    2.42 +        public int x() {
    2.43 +            return -1;
    2.44 +        }
    2.45 +    }
    2.46 +
    2.47 +    private int mI = 0;
    2.48 +    private float mF = 0;
    2.49 +    private boolean mZ = false;
    2.50 +    private X mX = new X();
    2.51 +    private long[] mArray = new long[331];
    2.52 +
    2.53 +    private void testMethod() {
    2.54 +        double d = 0;
    2.55 +
    2.56 +        for (int i = 0; i < 331; i++) {
    2.57 +            if (mZ) {
    2.58 +                continue;
    2.59 +            }
    2.60 +
    2.61 +            try {
    2.62 +                for (int j = mArray.length - 1; j >= 0; j--) {
    2.63 +                    for (int k = 0; k < 331; k++) {
    2.64 +                        d += ((double) new Double(d));
    2.65 +                        switch (267) {
    2.66 +                            case 256:
    2.67 +                            default: {
    2.68 +                                mF += (mX.x());
    2.69 +                                break;
    2.70 +                            }
    2.71 +                        }
    2.72 +                    }
    2.73 +                }
    2.74 +            } catch (Exception ignore) {
    2.75 +            }
    2.76 +        }
    2.77 +    }
    2.78 +
    2.79 +    public static void main(String[] args) {
    2.80 +        TestBeautifyLoops_2 obj = new TestBeautifyLoops_2();
    2.81 +        obj.testMethod();
    2.82 +    }
    2.83 +
    2.84 +}

mercurial