I just discovered this bug by manual code inspection, and found a reproducer.

It seems to be a regression of JDK-8248830, that is when RotateRightV was added to SuperWord.

The problem is that we directly get the input node, rather than the vector_opd, which fails if that input is not a vector already, but for example a PopulateIndex pattern that is only vectorized when calling vector_opd.

[~jbhateja] did this:

      } else if (VectorNode::is_scalar_rotate(n)) {
        Node* in1 = low_adr->in(1);
        Node* in2 = p->at(0)->in(2);

And by now it looks like this:

      } else if (VectorNode::is_scalar_rotate(n)) {
        Node* in1 = first->in(1);
        Node* in2 = first->in(2);

But at least in1 should be using vector_opd, like most other ops:

        Node* in1 = vector_opd(p, 1);

When the input is a PopulateIndex pattern, then "first->in(1)" gives us the iv-phi, which is a scalar. vector_opd would produce a PopulateIndex vector.

In the ad-file, we get an error, because we do not expect a scalar as the first operand of the RotateRightV, but a vector.

Reproduces on JDK23, JDK22, JDK21, maybe older.

/oracle-work/jdk-fork4/build/linux-x64-debug/jdk/bin/java -XX:CompileCommand=compileonly,TestRotate::* -Xbatch TestRotate.java

/oracle-work/jdk-21.0.3/fastdebug/bin/java -XX:CompileCommand=compileonly,TestRotate::* -Xbatch -XX:+UseSuperWord TestRotate.java

Disabling -XX:-UseSuperWord avoids the crash.

Strangely, product seems to run just fine.
But I'm not sure I'd trust the result... though it seems to be correct in the reproducer.

----------------------

sum: -1220673536
sum: -1220673536
sum: -1220673536
sum: -1220673536
sum: -1220673536
sum: -1220673536
sum: -1220673536
sum: -1220673536
sum: -1220673536
sum: -1220673536
o895 RotateRightV === _ o977 o137 [[ o896 ]] #vectorz[16]:{int}

--N: o895 RotateRightV === _ o977 o137 [[ o896 ]] #vectorz[16]:{int}

   --N: o977 AddI === _ o1176 o1198 [[ o895 ]]
   RREGI 110 addI_rReg_imm
   RAX_REGI 110 addI_rReg_imm
   RBX_REGI 110 addI_rReg_imm
   RCX_REGI 110 addI_rReg_imm
   RDX_REGI 110 addI_rReg_imm
   RDI_REGI 110 addI_rReg_imm
   NO_RAX_RDX_REGI 110 addI_rReg_imm
   NO_RBP_R13_REGI 110 addI_rReg_imm
   STACKSLOTI 210 storeSSI
   _AddI_rRegI_rRegI 100 _AddI_rRegI_rRegI

      --N: o1176 Phi === o1172 o1247 o242 [[ o1159 o1160 o1161 o1162 o1163 o1164 o242 o1058 o1057 o977 ]] #int #tripcount
      RREGI 0 RREGI
      RAX_REGI 0 RAX_REGI
      RBX_REGI 0 RBX_REGI
      RCX_REGI 0 RCX_REGI
      RDX_REGI 0 RDX_REGI
      RDI_REGI 0 RDI_REGI
      NO_RAX_RDX_REGI 0 NO_RAX_RDX_REGI
      NO_RBP_R13_REGI 0 NO_RBP_R13_REGI
      STACKSLOTI 100 storeSSI

      --N: o1198 ConI === o0 [[ o977 ]] #int:112
      IMMI 10 IMMI
      IMMU7 5 IMMU7
      IMMI8 5 IMMI8
      IMMU8 5 IMMU8
      IMMI16 10 IMMI16
      IMMU31 0 IMMU31
      RREGI 100 loadConI
      RAX_REGI 100 loadConI
      RBX_REGI 100 loadConI
      RCX_REGI 100 loadConI
      RDX_REGI 100 loadConI
      RDI_REGI 100 loadConI
      NO_RAX_RDX_REGI 100 loadConI
      NO_RBP_R13_REGI 100 loadConI
      STACKSLOTI 200 storeSSI

   --N: o137 ConI === o0 [[ o895 o262 o302 o906 o976 o1055 o1056 o1156 o1157 o1158 o1159 ]] #int:18
   IMMI 10 IMMI
   IMMU7 5 IMMU7
   IMMI8 5 IMMI8
   IMMU8 5 IMMU8
   IMMI16 10 IMMI16
   IMMU31 0 IMMU31
   RREGI 100 loadConI
   RAX_REGI 100 loadConI
   RBX_REGI 100 loadConI
   RCX_REGI 100 loadConI
   RDX_REGI 100 loadConI
   RDI_REGI 100 loadConI
   NO_RAX_RDX_REGI 100 loadConI
   NO_RBP_R13_REGI 100 loadConI
   STACKSLOTI 200 storeSSI

#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (/oracle-work/jdk-fork4/open/src/hotspot/share/opto/matcher.cpp:1727), pid=2026916, tid=2026930
# assert(false) failed: bad AD file
#
# JRE version: Java(TM) SE Runtime Environment (23.0) (fastdebug build 23-internal-2024-05-22-1054280.emanuel...)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (fastdebug 23-internal-2024-05-22-1054280.emanuel..., mixed mode, tiered, compressed oops, compressed class ptrs, g1 gc, linux-amd64)
# Problematic frame:
# V [libjvm.so+0x134c5da] Matcher::Label_Root(Node const*, State*, Node*, Node*&)+0x87a
#
# Core dump will be written. Default location: Core dumps may be processed with "/usr/share/apport/apport -p%p -s%s -c%c -d%d -P%P -u%u -g%g -- %E" (or dumping to /oracle-work/jdk-fork2/build/linux-x64-debug/jdk/bin/core.2026916)
#
# An error report file with more information is saved as:
# /oracle-work/jdk-fork2/build/linux-x64-debug/jdk/bin/hs_err_pid2026916.log
#
# Compiler replay data is saved as:
# /oracle-work/jdk-fork2/build/linux-x64-debug/jdk/bin/replay_pid2026916.log
#
# If you would like to submit a bug report, please visit:
# https://bugreport.java.com/bugreport/crash.jsp
#
Aborted (core dumped)