In recent days, we run some Java fuzzer tests with C2's experimental feature PostLoopMultiversioning and find a crash.

# To suppress the following error report, specify this argument
# after -XX: or in .hotspotrc: SuppressErrorAt=/subnode.cpp:688
#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (/home/penli01/jdk_src/src/hotspot/share/opto/subnode.cpp:688), pid=2675636, tid=2675649
# assert(cmp == __null) failed: A cmp with 2 OpaqueZeroTripGuard inputs
#
# JRE version: OpenJDK Runtime Environment (21.0) (fastdebug build 21-internal-adhoc.penli01.jdksrc)
# Java VM: OpenJDK 64-Bit Server VM (fastdebug 21-internal-adhoc.penli01.jdksrc, mixed mode, tiered, compressed oops, compressed class ptrs, g1 gc, linux-aarch64)
# Problematic frame:
# V [libjvm.so+0x1913b68] CmpINode::Value(PhaseGVN*) const+0x708
#
# Core dump will be written. Default location: /tmp/core.2675636
#
# An error report file with more information is saved as:
# /home/penli01/reduce2/hs_err_pid2675636.log
#
# Compiler replay data is saved as:
# /home/penli01/reduce2/replay_pid2675636.log
#
# If you would like to submit a bug report, please visit:
# https://bugreport.java.com/bugreport/crash.jsp
#

We narrowed down the fuzzer test case to a very small one. Below code can reproduce the crash on CPUs with masked vector support (x86 AVX-512 or AArch64 SVE).

public class Foo {
  private static short s;
  private static short[] sa = new short[400];

  private static void bar() {
    int i = 1, j = 1;
    while (i < 300) {
      j = 1;
      do {
        for (int k = j; k < 1; k--) {
          i++;
        }
        sa[i] = s;
      } while (++j < 6);
    }
  }

  public static void main(String[] args) {
    for (int i = 0; i < 20000; i++) {
      bar();
    }
  }
}

java -Xbatch -XX:+UnlockExperimentalVMOptions -XX:+PostLoopMultiversioning Foo