Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8154831

CastII/ConvI2L for a range check is prematurely eliminated

    Details

    • Subcomponent:
    • Introduced In Version:
    • Resolved In Build:
      b122

      Backports

        Description

        FULL PRODUCT VERSION :
        java version "1.8.0_92"
        Java(TM) SE Runtime Environment (build 1.8.0_92-b14)
        Java HotSpot(TM) 64-Bit Server VM (build 25.92-b14, mixed mode)

        FULL OS VERSION :
        Microsoft Windows [Version 6.1.7601]

        EXTRA RELEVANT SYSTEM CONFIGURATION :
        Eclipse Java EE IDE for Web Developers.

        Version: Mars.2 Release (4.5.2)
        Build id: 20160218-0600

        A DESCRIPTION OF THE PROBLEM :
        Attempt to use "Quick Outline" (Ctrl + O) on a big source file crashes IDE. After the crash 2 files are produced: hs_err_pid5920.log and replay_pid5920.log.

        Everything works fine with JDK8u77 and JDK8u91.

        THE PROBLEM WAS REPRODUCIBLE WITH -Xint FLAG: No

        THE PROBLEM WAS REPRODUCIBLE WITH -server FLAG: Yes

        REGRESSION. Last worked in version 8u91

        STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
        1. Start Eclipse IDE
        2. Open big source file
        3. Open "Quick Outline" and type some characters -> crash

        EXPECTED VERSUS ACTUAL BEHAVIOR :
        Expected: IDE works

        Actual: IDE exists due to JVM crash
        ERROR MESSAGES/STACK TRACES THAT OCCUR :
        #
        # A fatal error has been detected by the Java Runtime Environment:
        #
        # EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc=0x000000006f91c8df, pid=5920, tid=0x0000000000001dd8
        #
        # JRE version: Java(TM) SE Runtime Environment (8.0_92-b14) (build 1.8.0_92-b14)
        # Java VM: Java HotSpot(TM) 64-Bit Server VM (25.92-b14 mixed mode windows-amd64 compressed oops)
        # Problematic frame:
        # V [jvm.dll+0x4bc8df]
        #
        # Failed to write core dump. Minidumps are not enabled by default on client versions of Windows
        #
        # If you would like to submit a bug report, please visit:
        # http://bugreport.java.com/bugreport/crash.jsp
        #

        --------------- T H R E A D ---------------

        Current thread (0x0000000058d09000): JavaThread "C2 CompilerThread1" daemon [_thread_in_native, id=7640, stack(0x000000005a020000,0x000000005a120000)]

        siginfo: ExceptionCode=0xc0000005, reading address 0x0000000000000008

        ...

        Current CompileTask:
        C2: 23368 19417 4 org.eclipse.jdt.internal.compiler.parser.TypeConverter::decodeType (1094 bytes)


        REPRODUCIBILITY :
        This bug can be reproduced always.

        CUSTOMER SUBMITTED WORKAROUND :
        Switch to older JDK version, e.g. JDK8u77.

        1. 8154831.8u.patch
          1 kB
          Vladimir Ivanov
        2. jdk1.8.0_92_hs_err_pid5564.log
          37 kB
          Fairoz Matte
        3. jdk1.8.0_92_replay_pid5564.log
          825 kB
          Fairoz Matte

          Issue Links

            Activity

            Hide
            thartmann Tobias Hartmann added a comment -
            Okay, maybe we forgot to backport something or it's just not triggered with 9 for another reason.
            Show
            thartmann Tobias Hartmann added a comment - Okay, maybe we forgot to backport something or it's just not triggered with 9 for another reason.
            Hide
            vlivanov Vladimir Ivanov added a comment -
            noreg-hard: wasn't able to write a regression test. Very peculiar IR shape is required to trigger the bug.
            Show
            vlivanov Vladimir Ivanov added a comment - noreg-hard: wasn't able to write a regression test. Very peculiar IR shape is required to trigger the bug.
            Hide
            vlivanov Vladimir Ivanov added a comment - - edited
            CastII node prematurely goes away and causes a cascade of other eliminations which severely corrupts the graph (the actual crash happens due to a memory edge coming from a non-dominating region).

            CastII is replaced with TOP due to a type conflict (ranges don't intersect) between the actual type of the value being range checked and the type CastII tries to assign.

            It happens on effectively dead path (range check always fails) which C2 can't eliminate due to a missing transformation for CmpU:

               Bool [lt] (CmpU (ConI #-1) (… #int)) => (ConI #0)

            The fix is to add the missing case in CmpUNode::sub(). It enables dead path elimination along with CastII.
            Show
            vlivanov Vladimir Ivanov added a comment - - edited CastII node prematurely goes away and causes a cascade of other eliminations which severely corrupts the graph (the actual crash happens due to a memory edge coming from a non-dominating region). CastII is replaced with TOP due to a type conflict (ranges don't intersect) between the actual type of the value being range checked and the type CastII tries to assign. It happens on effectively dead path (range check always fails) which C2 can't eliminate due to a missing transformation for CmpU:    Bool [lt] (CmpU (ConI #-1) (… #int)) => (ConI #0) The fix is to add the missing case in CmpUNode::sub(). It enables dead path elimination along with CastII.
            Hide
            hgupdate HG Updates added a comment -
            URL: http://hg.openjdk.java.net/jdk9/hs-comp/hotspot/rev/b3bb54a37da0
            User: vlivanov
            Date: 2016-05-20 17:34:30 +0000
            Show
            hgupdate HG Updates added a comment - URL: http://hg.openjdk.java.net/jdk9/hs-comp/hotspot/rev/b3bb54a37da0 User: vlivanov Date: 2016-05-20 17:34:30 +0000
            Hide
            hgupdate HG Updates added a comment -
            URL: http://hg.openjdk.java.net/jdk9/jdk9/hotspot/rev/b3bb54a37da0
            User: lana
            Date: 2016-06-08 20:34:57 +0000
            Show
            hgupdate HG Updates added a comment - URL: http://hg.openjdk.java.net/jdk9/jdk9/hotspot/rev/b3bb54a37da0 User: lana Date: 2016-06-08 20:34:57 +0000

              People

              • Assignee:
                vlivanov Vladimir Ivanov
                Reporter:
                webbuggrp Webbug Group
              • Votes:
                0 Vote for this issue
                Watchers:
                6 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: