While working on JDK-8237859, we have discovered that control edges from RangeCheck loop predicates (which replaced RangeCheck nodes in the loop) to LoadP nodes are not updated when unswitching a loop and then creating pre/main/post loops for both unswitched versions (see comments in JDK-8237859). As a result, the main loop can be overunrolled and made not entrant but an optimized LoadP which makes an out-of-bounds access is scheduled even before the loop unswitching if.

A closer look at loop unswitching suggests that we need to copy the loop predicates down to both unswitched versions anyways. Otherwise, the pre/main/post code does not find the original loop predicates anymore due to the added loop selection if statement. It could then overunroll the main loop without properly updating the range check predicates. This has not been observed, yet. However, when running the attached test which overunrolls both unswitched loops, we hit the bad AD file assertion below which must be related to the missing loop predicates that need to be copied down to the main loop while creating pre/main/post loops. The same assertion error was reported originally before cloning the predicates down to the main loop while creating pre/main/post loops in JDK-8203915.


Default case invoked for:
   opcode = 106, "Con"
o1 Con === o0 [[]] #top

--N: o1 Con === o0 [[]] #top

# To suppress the following error report, specify this argument
# after -XX: or in .hotspotrc: SuppressErrorAt=/matcher.cpp:1563
#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (open/src/hotspot/share/opto/matcher.cpp:1563), pid=4259, tid=4271
# assert(false) failed: bad AD file
#
# JRE version: Java(TM) SE Runtime Environment (15.0) (slowdebug build 15-internal+0-2019-11-08-0757471.christian...)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (slowdebug 15-internal+0-2019-11-08-0757471.christian..., compiled mode, compressed oops, g1 gc, linux-amd64)
# Problematic frame:
# V [libjvm.so+0xd99893] Matcher::Label_Root(Node const*, State*, Node*, Node const*)+0x4d3
#
# Core dump will be written. Default location: Core dumps may be processed with "/usr/share/apport/apport %p %s %c %d %P" (or dumping to /home/christian/jdk/open/core.4259)
#
# An error report file with more information is saved as:
# /home/christian/jdk/open/hs_err_pid4259.log
#
# Compiler replay data is saved as:
# /home/christian/jdk/open/replay_pid4259.log
#
# If you would like to submit a bug report, please visit:
# https://bugreport.java.com/bugreport/crash.jsp
#
Current thread is 4271
Dumping core ...
Aborted (core dumped)


Reproduce:
java -Xcomp -XX:+TraceLoopOpts -XX:-TieredCompilation -XX:CompileCommand=compileonly,Overunrolling::test5 Overunrolling.java

The attached test was adapted from compiler/loopopts/TestOverunrolling::test5 by adding an additional if statement to trigger loop unswitching.