C2 SuperWord: VTransform::add_speculative_check uses pre_init that is pinned after Auto_Vectorization_Check, leading to bad graph

XMLWordPrintable

    • b26

      It looks like a regression from JDK-8324751, where we add aliasing runtime checks.

      VTransform::add_speculative_check
      Inserts a runtime check before at the ParsePredicate that is before the pre-loop. For this, it requires the pre_init value, which is available before the pre loop. In most cases, it is also already available before the ParsePredicate, but in rare cases that assumption does not hold. In the fuzzer case, there is a CastII pinning the pre_init value after the ParsePredicate for the auto vectorization check. If we use that value and insert a runtime check before the ParsePredicate, then that leads to a circular graph, hence a "bad graph" assert.
      See also the attached images below, especially img2 and img3.

      Solution Idea:
      We may have to improve our checks, and not just check that the values we use are pre-loop independent, but also available before the ParsePredicate for the Auto_Vectorization_Check.

      We need to look at places like:
      VPointer::can_make_speculative_aliasing_check_with

      --------------------- Original Report -----------------------

      java -XX:CompileCommand=quiet -XX:CompileCommand=compileonly,Test::mainTest -XX:RepeatCompilation=100 -XX:-TieredCompilation -Xcomp -XX:+StressLoopPeeling Test.java

      Bad graph detected in build_loop_late
      n: 5762 Bool === _ 5761 [[ 5713 ]] [ne]
      early(n): 1897 IfTrue === 1896 [[ 2445 2584 2464 2607 2458 2456 2452 2450 ]] #1 !orig=[2482],950 !jvms: Test::mainTest @ bci:125 (line 137)
      n->in(1): 5761 CmpI === _ 5760 38 [[ 5762 ]]
      early(n->in(1)): 1897 IfTrue === 1896 [[ 2445 2584 2464 2607 2458 2456 2452 2450 ]] #1 !orig=[2482],950 !jvms: Test::mainTest @ bci:125 (line 137)
      n->in(1)->in(1): 5760 OrI === _ 5813 5815 [[ 5761 ]]
      early(n->in(1)->in(1)): 1897 IfTrue === 1896 [[ 2445 2584 2464 2607 2458 2456 2452 2450 ]] #1 !orig=[2482],950 !jvms: Test::mainTest @ bci:125 (line 137)
      n->in(1)->in(2): 38 ConI === 0 [[ 57 93 1667 190 1431 765 513 146 146 157 157 168 168 179 179 190 503 493 1783 350 483 473 1444 310 310 320 320 330 330 340 340 350 1385 1396 1427 1440 1868 1323 606 616 1869 626 566 636 2265 1218 1239 1254 1203 1869 3119 1431 5761 5813 5815 5695 5808 5806 5235 ]] #int:0
      early(n->in(1)->in(2)): 0 Root === 0 150 161 172 183 194 1207 314 324 334 344 354 5521 477 487 497 507 517 610 620 630 640 2565 3067 1328 3141 1327 1243 1258 2520 3220 5510 1222 3056 3045 3187 4933 2542 2366 3175 2127 2139 2150 2161 2173 2184 2195 2206 2287 2587 4922 2321 2333 4623 4955 2988 3000 3011 3022 3034 4096 4601 4944 4134 4448 4459 [[ 0 1 3 22 1318 24 25 26 27 28 29 1292 31 32 33 1169 36 38 1151 40 1135 42 2654 46 1034 1032 930 53 866 858 81 848 85 846 89 1322 124 145 156 167 178 189 2637 232 255 271 272 287 821 782 779 454 455 456 459 461 773 556 762 593 736 735 2628 2023 2021 1693 1600 1457 1584 1477 1464 2723 2791 2840 2841 3378 3379 3407 3408 3409 3411 3412 3413 3425 3434 3437 3438 3453 3454 3455 4066 4074 4081 4139 4140 4142 4153 4170 4183 4184 4336 4437 4638 4685 4695 4698 4700 4710 4712 4961 4972 4978 5318 5634 5771 5787 5788 5790 5823 5825 5837 5840 5842 5847 5852 ]]

      LCA(n): 1905 IfTrue === 1904 [[ 5713 5733 ]] #1
      n->out(0): 5713 If === 1905 5762 [[ 5714 5715 ]] P=0.999999, C=-1.000000
      n->out(0)->out(0): 5714 IfTrue === 5713 [[ 1896 ]] #1
      n->out(0)->out(1): 5715 IfFalse === 5713 [[ 1894 ]] #0

      idoms of early "1897 IfTrue":
      idom[3]: 1905 IfTrue
      idom[2]: 5713 If
      idom[1]: 5714 IfTrue
      idom[0]: 1896 ParsePredicate
      n: 1897 IfTrue

      idoms of (wrong) LCA "1905 IfTrue":
      n: 1905 IfTrue

      Real LCA of early "1897 IfTrue" (idom[3]) and wrong LCA "1905 IfTrue":
       1905 IfTrue === 1904 [[ 5713 5733 ]] #1

      # A fatal error has been detected by the Java Runtime Environment:
      #
      # Internal Error (workspace/open/src/hotspot/share/opto/loopnode.cpp:6851), pid=3656089, tid=3656108
      # assert(false) failed: Bad graph detected in build_loop_late
      #
      # JRE version: Java(TM) SE Runtime Environment (26.0+23) (fastdebug build 26-ea+23-2304)
      # Java VM: Java HotSpot(TM) 64-Bit Server VM (fastdebug 26-ea+23-2304, compiled mode, sharing, compressed oops, compressed class ptrs, g1 gc, linux-aarch64)
      # Problematic frame:
      # V [libjvm.so+0x1322d28] PhaseIdealLoop::build_loop_late_post_work(Node*, bool)+0x888

      Current CompileTask:
      C2:185 5 !b Test::mainTest (650 bytes)

      Stack: [0x0000ffff89bf4000,0x0000ffff89df2000], sp=0x0000ffff89dec4f0, free space=2017k
      Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
      V [libjvm.so+0x1322d28] PhaseIdealLoop::build_loop_late_post_work(Node*, bool)+0x888 (loopnode.cpp:6851)
      V [libjvm.so+0x1322f08] PhaseIdealLoop::build_loop_late(VectorSet&, Node_List&, Node_Stack&)+0x19c (loopnode.cpp:6718)
      V [libjvm.so+0x1323770] PhaseIdealLoop::build_and_optimize()+0x610 (loopnode.cpp:5111)
      V [libjvm.so+0x9c64e0] PhaseIdealLoop::optimize(PhaseIterGVN&, LoopOptsMode)+0x340 (loopnode.hpp:1233)
      V [libjvm.so+0x9be9e8] Compile::optimize_loops(PhaseIterGVN&, LoopOptsMode)+0x88 (compile.cpp:2262)
      V [libjvm.so+0x9c0e78] Compile::Optimize()+0xa70 (compile.cpp:2511)
      V [libjvm.so+0x9c3450] Compile::Compile(ciEnv*, ciMethod*, int, Options, DirectiveSet*)+0x16a4 (compile.cpp:860)
      V [libjvm.so+0x7ee880] C2Compiler::compile_method(ciEnv*, ciMethod*, int, bool, DirectiveSet*)+0x2dc (c2compiler.cpp:147)
      V [libjvm.so+0x9d216c] CompileBroker::invoke_compiler_on_method(CompileTask*)+0xb08 (compileBroker.cpp:2345)
      V [libjvm.so+0x9d3098] CompileBroker::compiler_thread_loop()+0x638 (compileBroker.cpp:1989)
      V [libjvm.so+0xed4268] JavaThread::thread_main_inner()+0x108 (javaThread.cpp:771)
      V [libjvm.so+0x184a73c] Thread::call_run()+0xac (thread.cpp:243)
      V [libjvm.so+0x15288fc] thread_native_entry(Thread*)+0x12c (os_linux.cpp:883)
      C [libc.so.6+0x80b50] start_thread+0x300

        1. FuzzerUtils.java
          13 kB
          Tobias Hartmann
        2. Test.java
          8 kB
          Tobias Hartmann
        3. hs_err_pid3656089.log
          66 kB
          Tobias Hartmann
        4. replay_pid3656089.log
          128 kB
          Tobias Hartmann
        5. TestReduced.java
          1 kB
          Roberto Castaneda Lozano
        6. after-8324751.out
          5 kB
          Roberto Castaneda Lozano
        7. before-8324751.out
          3 kB
          Roberto Castaneda Lozano
        8. img0_circular_graph_at_assert.png
          76 kB
          Emanuel Peter
        9. img1_circular_graph_after_check_inserted.png
          109 kB
          Emanuel Peter
        10. img2_before_check_insertion.png
          41 kB
          Emanuel Peter
        11. img3_after_check_insertion.png
          85 kB
          Emanuel Peter

            Assignee:
            Emanuel Peter
            Reporter:
            Tobias Hartmann
            Votes:
            0 Vote for this issue
            Watchers:
            7 Start watching this issue

              Created:
              Updated:
              Resolved: