Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8166110

Inlining through MH invokers/linkers in unreachable code is unsafe

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: P3
    • Resolution: Fixed
    • Affects Version/s: 9
    • Fix Version/s: 9
    • Component/s: hotspot
    • Labels:
      None
    • Subcomponent:
    • Resolved In Build:
      b159

      Backports

        Description

        With the preliminary patch for JDK-8161211 applied in 9-dev, this crash is reproducible:

        # Internal Error (/.../hotspot/src/share/vm/opto/doCall.cpp:719), pid=29519, tid=29587
        # assert(check_call_consistency(jvms, cg)) failed: inconsistent info

        Details from fastdebug build:

        JVMS depth=1 loc=5 stk=19 arg=19 mon=25 scalar=25 end=25 mondepth=0 sp=0 bci=101 reexecute=false method=static jint java.lang.invoke.LambdaForm$MH022/728637067.loop_002(jobject, jobject)
           bc: JVMS depth=2 loc=5 stk=8 arg=8 mon=13 scalar=13 end=13 mondepth=0 sp=0 bci=123 reexecute=false method=virtual jobject java.lang.invoke.BoundMethodHandle.arg(jint)
           bc: Bytecode info:
        <ciMethod name=invokeBasic holder=java/lang/invoke/MethodHandle signature=(Ljava/lang/Object;)D loaded=true arg_size=2 flags=DEFAULT_ACCESS,final,native ident=1114 address=0x00007f44706106e0>

        The code to reproduce this is as follows:

        import java.lang.invoke.MethodHandle;
        import java.lang.invoke.MethodHandles;
        import java.lang.invoke.MethodType;

        public class Main {

           public static void main(String[] args) throws Throwable {
               MethodHandle h = makeLoop();
               for (int i = 0; i < 100; ++i) {
                   System.err.print(i);
                   h.invoke();
                   System.err.println();
               }
           }

           static MethodHandle makeLoop() throws Throwable {
               MethodHandle it = MethodHandles.constant(int.class, 10000);
               MethodHandle bo =
                       MethodHandles.lookup().findStatic(Main.class, "body", MethodType.methodType(void.class, int.class));
               return MethodHandles.countedLoop(it, null, bo);
           }

           static void body(int x) {
               if (x % 100 == 0) {
                   System.err.print('.');
               }
           }

        }

        [~vlivanov]'s analysis:

        The assertion is too strong for the case when C2 processes never-taken branch.

        Some details:

        jdk/src/java.base/share/classes/java/lang/invoke/BoundMethodHandle.java:

        final Object arg(int i) {
           try {
               switch (speciesData().fieldType(i)) {
               case L_TYPE: return speciesData().getters[i].invokeBasic(this);
               case I_TYPE: return (int) speciesData().getters[i].invokeBasic(this);
               case J_TYPE: return (long) speciesData().getters[i].invokeBasic(this);
               case F_TYPE: return (float) speciesData().getters[i].invokeBasic(this);
               case D_TYPE: return (double) speciesData().getters[i].invokeBasic(this);
               }
           } catch (Throwable ex) {
               throw newInternalError(ex);
           }
           throw new InternalError("unexpected type: " + speciesData().typeChars+"."+i);
        }

        Even for constant BMH receiver & constant argument, C2 can't constant fold speciesData().fieldType(i), since SpeciesData.typeCodes[] isn't @Stable. Without @Stable, C2 can't contant-fold element loads from arrays.

        But it can inline through speciesData().getters[i], since SpeciesData.getters is @Stable. So, the assertion is fired when inlining on never-taken branch happens.

        Note by [~mhaupt]: The crash happens with the @Stable annotation on basicTypes. These seems to be nothing that speaks against adding it, though.

          Attachments

            Issue Links

              Activity

                People

                Assignee:
                dchuyko Dmitry Chuyko
                Reporter:
                mhaupt Michael Haupt
                Votes:
                0 Vote for this issue
                Watchers:
                4 Start watching this issue

                  Dates

                  Created:
                  Updated:
                  Resolved: