Looks similar to JDK-8230397 (different projection though) that was fixed in Valhalla and assumed to be Valhalla specific.

Only seems to reproduce with replay file, and only on JDK22.0.1

Other versions are probably affected, but the replay file does not work with them. Once the bug is better understood, hopefully we can find a reproducer that triggers on other versions as well.

emanuel@emanuel-oracle:/oracle-work/triage/current$ /oracle-work/jdk-22.0.1/fastdebug/bin/java -XX:+ReplayCompiles -XX:+ReplayIgnoreInitErrors -XX:ReplayDataFile=replay_pid63846.log -XX:TypeProfileLevel=222
Resolving klass jdk/internal/reflect/Reflection at 153
Resolving klass jdk/internal/reflect/ReflectionFactory at 306
Resolving klass java/lang/Class$ReflectionData at 414
Resolving klass java/lang/PublicMethods$MethodList at 690
Resolving klass java/lang/Class$Atomic at 883
Resolving klass jdk/internal/reflect/ReflectionFactory$GetReflectionFactoryAction at 1040
Resolving klass java/util/Objects at 79
Resolving klass java/nio/charset/Charset at 84
Resolving klass sun/nio/cs/UTF_8 at 87
Resolving klass java/lang/StringCoding at 93
Resolving klass java/lang/Object at 4
Resolving klass java/lang/System at 18
Resolving klass java/io/PrintStream at 26
Resolving klass TypeConfusionAndErrorHandlingInPolymorphism$Cat at 7
Resolving klass TypeConfusionAndErrorHandlingInPolymorphism$Dog at 9
Resolving klass TypeConfusionAndErrorHandlingInPolymorphism$Animal at 11
Resolving klass java/lang/Object at 4
#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (/opt/mach5/mesos/work_dir/slaves/0db9c48f-6638-40d0-9a4b-bd9cc7533eb8-S9823/frameworks/1735e8a2-a1db-478c-8104-60c8b0af87dd-0196/executors/d7a39ecb-8e74-462f-9377-5fdd29fc3ad4/runs/e53d9f60-7204-454a-984d-c6ce345ab850/workspace/open/src/hotspot/share/opto/callnode.cpp:967), pid=299318, tid=299332
# assert(!do_asserts || projs->fallthrough_ioproj != nullptr) failed: must be found
#
# JRE version: Java(TM) SE Runtime Environment (22.0.1+7) (fastdebug build 22.0.1+7-15)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (fastdebug 22.0.1+7-15, mixed mode, sharing, tiered, compressed oops, compressed class ptrs, g1 gc, linux-amd64)
# Problematic frame:
# V [libjvm.so+0x84fb81] CallNode::extract_projections(CallProjections*, bool, bool)+0x6d1
#
# Core dump will be written. Default location: Core dumps may be processed with "/usr/share/apport/apport -p%p -s%s -c%c -d%d -P%P -u%u -g%g -- %E" (or dumping to /oracle-work/triage/current/core.299318)
#
# An error report file with more information is saved as:
# /oracle-work/triage/current/hs_err_pid299318.log
#
# If you would like to submit a bug report, please visit:
# https://bugreport.java.com/bugreport/crash.jsp
#
Aborted (core dumped)


Current CompileTask:
C2:152 1 !b 4 TypeConfusionAndErrorHandlingInPolymorphism::main (75 bytes)

Stack: [0x00007fecc8707000,0x00007fecc8808000], sp=0x00007fecc88031b0, free space=1008k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.so+0x84fb81] CallNode::extract_projections(CallProjections*, bool, bool)+0x6d1 (callnode.cpp:967)
V [libjvm.so+0x843705] CallGenerator::do_late_inline_helper()+0x425
V [libjvm.so+0x9e8e74] Compile::inline_incrementally_one()+0xd4
V [libjvm.so+0x9e9748] Compile::process_late_inline_calls_no_inline(PhaseIterGVN&)+0x78
V [libjvm.so+0x9ec84e] Compile::Optimize()+0xffe
V [libjvm.so+0x9efd7b] Compile::Compile(ciEnv*, ciMethod*, int, Options, DirectiveSet*)+0x1beb
V [libjvm.so+0x83bbd7] C2Compiler::compile_method(ciEnv*, ciMethod*, int, bool, DirectiveSet*)+0x1e7
V [libjvm.so+0x9fb6ec] CompileBroker::invoke_compiler_on_method(CompileTask*)+0x92c
V [libjvm.so+0x9fc378] CompileBroker::compiler_thread_loop()+0x468
V [libjvm.so+0xeba3bc] JavaThread::thread_main_inner()+0xcc
V [libjvm.so+0x17a0de6] Thread::call_run()+0xb6
V [libjvm.so+0x14ab017] thread_native_entry(Thread*)+0x127



PRODUCT:

emanuel@emanuel-oracle:/oracle-work/triage/current$ /oracle-work/jdk-22/bin/java -XX:+UnlockDiagnosticVMOptions -XX:+ReplayCompiles -XX:+ReplayIgnoreInitErrors -XX:ReplayDataFile=replay_pid63846.log -XX:TypeProfileLevel=222
java.lang.NoClassDefFoundError: jdk/internal/misc/MethodFinder
Error while parsing line 328 at position 41: constant pool length mismatch: wrong class files?

Error while parsing line 340 at position 56: constant pool length mismatch: wrong class files?

Warning: entry was unresolved in the replay data: java/lang/Throwable
Error while parsing line 352 at position 44: constant pool length mismatch: wrong class files?

Error while parsing line 363 at position 42: constant pool length mismatch: wrong class files?

Error while parsing line 371 at position 39: constant pool length mismatch: wrong class files?

Error while parsing line 430 at position 42: constant pool length mismatch: wrong class files?

Error while parsing line 436 at position 333: tag mismatch: wrong class files?

Error while parsing line 460 at position 48: constant pool length mismatch: wrong class files?

Error while parsing line 472 at position 450: tag mismatch: wrong class files?

Error while parsing line 473 at position 61: constant pool length mismatch: wrong class files?

Error while parsing line 518 at position 53: constant pool length mismatch: wrong class files?

Warning: entry was unresolved in the replay data: java/lang/Exception
Error while parsing line 577 at position 46: constant pool length mismatch: wrong class files?

Warning: entry was unresolved in the replay data: java/io/ObjectStreamField
Warning: entry was unresolved in the replay data: java/lang/LinkageError
Error while parsing line 644 at position 66: constant pool length mismatch: wrong class files?

Error while parsing line 657 at position 52: constant pool length mismatch: wrong class files?

Resolving klass java/lang/Object at 4
Resolving klass java/lang/System at 18
Resolving klass java/io/PrintStream at 26
Resolving klass TypeConfusionAndErrorHandlingInPolymorphism$Cat at 7
Resolving klass TypeConfusionAndErrorHandlingInPolymorphism$Dog at 9
Resolving klass TypeConfusionAndErrorHandlingInPolymorphism$Animal at 11
Resolving klass java/lang/Object at 4
#
# A fatal error has been detected by the Java Runtime Environment:
#
# SIGSEGV (0xb) at pc=0x00007f1ee5159e9c, pid=302481, tid=302495
#
# JRE version: Java(TM) SE Runtime Environment (22.0+19) (build 22-ea+19-1460)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (22-ea+19-1460, mixed mode, sharing, tiered, compressed oops, compressed class ptrs, g1 gc, linux-amd64)
# Problematic frame:
# V [libjvm.so+0x5b4e9c] ciInstanceKlass::compute_transitive_interfaces()+0x24c
#
# Core dump will be written. Default location: Core dumps may be processed with "/usr/share/apport/apport -p%p -s%s -c%c -d%d -P%P -u%u -g%g -- %E" (or dumping to /oracle-work/triage/current/core.302481)
#
# An error report file with more information is saved as:
# /oracle-work/triage/current/hs_err_pid302481.log
#
# If you would like to submit a bug report, please visit:
# https://bugreport.java.com/bugreport/crash.jsp
#
Aborted (core dumped)

Current CompileTask:
C2:94 1 !b 4 TypeConfusionAndErrorHandlingInPolymorphism::main (75 bytes)

Stack: [0x00007f1eaea51000,0x00007f1eaeb52000], sp=0x00007f1eaeb4e950, free space=1014k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.so+0x5b4e9c] ciInstanceKlass::compute_transitive_interfaces()+0x24c
V [libjvm.so+0x5b51a1] ciInstanceKlass::transitive_interfaces() const+0x21
V [libjvm.so+0xebc2f4] TypePtr::InterfaceSet::eq(ciInstanceKlass*) const+0x14
V [libjvm.so+0xec2223] TypePtr::InterfaceSet::InterfaceSet(GrowableArray<ciInstanceKlass*>*)+0x1d3
V [libjvm.so+0xec2315] TypePtr::interfaces(ciKlass*&, bool, bool, bool, Type::InterfaceHandling)+0x65
V [libjvm.so+0xec2689] TypeOopPtr::make_from_klass_common(ciKlass*, bool, bool, Type::InterfaceHandling)+0xb9
V [libjvm.so+0xd0ec5f] Parse::do_get_xxx(Node*, ciField*, bool)+0x48f
V [libjvm.so+0xd0f37a] Parse::do_field_access(bool, bool)+0x15a
V [libjvm.so+0xcfd6f0] Parse::do_one_block()+0x210
V [libjvm.so+0xcfdae5] Parse::do_all_blocks()+0xe5
V [libjvm.so+0xd001b5] Parse::Parse(JVMState*, ciMethod*, float)+0x725
V [libjvm.so+0x577b0b] ParseGenerator::generate(JVMState*)+0x8b
V [libjvm.so+0x64b5e6] Compile::Compile(ciEnv*, ciMethod*, int, Options, DirectiveSet*)+0xd16
V [libjvm.so+0x57690b] C2Compiler::compile_method(ciEnv*, ciMethod*, int, bool, DirectiveSet*)+0x17b
V [libjvm.so+0x65135e] CompileBroker::invoke_compiler_on_method(CompileTask*)+0xa9e
V [libjvm.so+0x654468] CompileBroker::compiler_thread_loop()+0x4b8
V [libjvm.so+0x8fd238] JavaThread::thread_main_inner() [clone .part.0]+0xb8
V [libjvm.so+0xea4588] Thread::call_run()+0xa8
V [libjvm.so+0xccb8ea] thread_native_entry(Thread*)+0xda