C2 crash in PhaseCCP::verify_type - fatal error: Not monotonic

XMLWordPrintable

    • Fix Understood

      The attached Java Fuzzer test starts to fail after JDK-8367341 (notice that it also failed with RunThese30M.java, see original report further down):

      To reproduce:
      $ java -XX:CompileCommand=compileonly,*Test*::* -Xcomp Test.java
      $ java -XX:CompileCommand=compileonly,*Reduced*::* -Xcomp Reduced.java

      Output:
       1387 AddI === _ 1278 1521 [[ 500 608 1285 ]] !orig=510,... !jvms: Test_1149::vMeth @ bci:121 (line 114)
        482 RShiftI === _ 1397 326 [[ 620 500 ]] !orig=594 !jvms: Test_1149::vMeth @ bci:91 (line 110)
        500 XorI === _ 482 1387 [[ 502 ]] !jvms: Test_1149::vMeth @ bci:109 (line 113)
      told = int:-2..3, 0u..maxuint, widen: 3
      tnew = int:-4..3, 0u..maxuint

      Failure:
      #
      # A fatal error has been detected by the Java Runtime Environment:
      #
      # Internal Error (/opt/mach5/mesos/work_dir/slaves/da1065b5-7b94-4f0d-85e9-a3a252b9a32e-S35605/frameworks/1735e8a2-a1db-478c-8104-60c8b0af87dd-0196/executors/4a69a793-a431-44f8-aeef-1b5ab7de3ccc/runs/d01e7687-e9ea-41b1-929f-b4f667f0f9b8/workspace/open/src/hotspot/share/opto/phaseX.cpp:2796), pid=256306, tid=256336
      # fatal error: Not monotonic
      #
      # JRE version: Java(TM) SE Runtime Environment (27.0+4) (fastdebug build 27-ea+4-219)
      # Java VM: Java HotSpot(TM) 64-Bit Server VM (fastdebug 27-ea+4-219, compiled mode, sharing, tiered, compressed oops, compressed class ptrs, g1 gc, linux-amd64)
      # Problematic frame:
      # V [libjvm.so+0x1898b49] PhaseCCP::verify_type(Node*, Type const*, Type const*)+0x169
      ................
      Command Line: -Xmx1G -XX:+IgnoreUnrecognizedVMOptions -XX:CompileCommand=quiet -XX:CompileCommand=compileonly,*Test*::* -Xcomp Test_1149
      ................
      Current CompileTask:
      C2:166 10 b 4 Test_1149::vMeth (241 bytes)

      Stack: [0x00007fdcdbf00000,0x00007fdcdc000000], sp=0x00007fdcdbffae90, free space=1003k
      Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
      V [libjvm.so+0x1898b49] PhaseCCP::verify_type(Node*, Type const*, Type const*)+0x169 (phaseX.cpp:2796)
      V [libjvm.so+0x189d9f9] PhaseCCP::analyze_step(Unique_Node_List&, Node*)+0x59 (phaseX.cpp:2865)
      V [libjvm.so+0x18a199b] PhaseCCP::analyze()+0x5bb (phaseX.cpp:2842)
      V [libjvm.so+0xbb2df5] Compile::Optimize()+0x965 (compile.cpp:2495)
      V [libjvm.so+0xbb62f3] Compile::Compile(ciEnv*, ciMethod*, int, Options, DirectiveSet*)+0x2023 (compile.cpp:862)
      V [libjvm.so+0x9cd528] C2Compiler::compile_method(ciEnv*, ciMethod*, int, bool, DirectiveSet*)+0x498 (c2compiler.cpp:147)
      V [libjvm.so+0xbc57e0] CompileBroker::invoke_compiler_on_method(CompileTask*)+0x780 (compileBroker.cpp:2345)
      V [libjvm.so+0xbc7040] CompileBroker::compiler_thread_loop()+0x530 (compileBroker.cpp:1989)
      V [libjvm.so+0x112a43b] JavaThread::thread_main_inner()+0x13b (javaThread.cpp:776)
      V [libjvm.so+0x1bb59b6] Thread::call_run()+0xb6 (thread.cpp:242)
      V [libjvm.so+0x180ba18] thread_native_entry(Thread*)+0x118 (os_linux.cpp:860)


      =============
      Original report:

      Test applications/runthese/RunThese30M.java

      #
      # A fatal error has been detected by the Java Runtime Environment:
      #
      # Internal Error (/opt/mach5/mesos/work_dir/slaves/da1065b5-7b94-4f0d-85e9-a3a252b9a32e-S35732/frameworks/1735e8a2-a1db-478c-8104-60c8b0af87dd-0196/executors/6da1416c-627e-4540-8e4d-2a54ac0ef285/runs/71a5f00b-6a1a-4b8d-a50c-d0a7aa1c061a/workspace/open/src/hotspot/share/opto/phaseX.cpp:2796), pid=2503386, tid=2503446
      # fatal error: Not monotonic
      #
      # JRE version: Java(TM) SE Runtime Environment (27.0+3) (fastdebug build 27-ea+3-160)
      # Java VM: Java HotSpot(TM) 64-Bit Server VM (fastdebug 27-ea+3-160, compiled mode, compressed class ptrs, g1 gc, linux-amd64)
      # Problematic frame:
      # V [libjvm.so+0x1895589] PhaseCCP::verify_type(Node*, Type const*, Type const*)+0x169
      #
      # Core dump will be written. Default location: Determined by the following: "/opt/core.sh %p" (alternatively, falling back to /opt/mach5/mesos/work_dir/slaves/da1065b5-7b94-4f0d-85e9-a3a252b9a32e-S35678/frameworks/1735e8a2-a1db-478c-8104-60c8b0af87dd-0196/executors/e1c59945-8c1b-4a39-80d2-d2287c25935f/runs/89138348-266d-4684-825c-a7a9b0a2bccf/testoutput/test-support/jtreg_closed_test_hotspot_jtreg_applications_runthese_RunThese30M_java/scratch/0/core.2503386)
      #
      # If you would like to submit a bug report, please visit:
      # https://bugreport.java.com/bugreport/crash.jsp
      #

      --------------- S U M M A R Y ------------

      Command Line: -Xbootclasspath/a:/opt/mach5/mesos/work_dir/slaves/da1065b5-7b94-4f0d-85e9-a3a252b9a32e-S35678/frameworks/1735e8a2-a1db-478c-8104-60c8b0af87dd-0196/executors/e1c59945-8c1b-4a39-80d2-d2287c25935f/runs/89138348-266d-4684-825c-a7a9b0a2bccf/testoutput/test-support/jtreg_closed_test_hotspot_jtreg_applications_runthese_RunThese30M_java/scratch/0/wb.jar -XX:+UnlockDiagnosticVMOptions -XX:+WhiteBoxAPI -XX:MaxRAMPercentage=4.16667 -Dtest.boot.jdk=/opt/mach5/mesos/work_dir/jib-master/install/jdk/25/37/bundles/linux-x64/jdk-25_linux-x64_bin.tar.gz/jdk-25 -Djava.io.tmpdir=/opt/mach5/mesos/work_dir/slaves/da1065b5-7b94-4f0d-85e9-a3a252b9a32e-S35678/frameworks/1735e8a2-a1db-478c-8104-60c8b0af87dd-0196/executors/e1c59945-8c1b-4a39-80d2-d2287c25935f/runs/89138348-266d-4684-825c-a7a9b0a2bccf/testoutput/test-support/jtreg_closed_test_hotspot_jtreg_applications_runthese_RunThese30M_java/tmp -Xcomp -ea -esa -XX:CompileThreshold=100 -XX:+UnlockExperimentalVMOptions -XX:-TieredCompilation -XX:-UseCompressedOops -XX:MaxRAMPercentage=50 -Djava.net.preferIPv6Addresses=false -XX:+DisplayVMOutputToStderr -Xlog:gc*,gc+heap=debug:gc.log:uptime,timemillis,level,tags -XX:+DisableExplicitGC -XX:+StartAttachListener -XX:CompileCommand=memlimit,*.*,0 -Xlog:monitorinflation=info:file=../monitorinflation.log::filesize=500m -Djava.io.tmpdir=/opt/mach5/mesos/work_dir/slaves/da1065b5-7b94-4f0d-85e9-a3a252b9a32e-S35678/frameworks/1735e8a2-a1db-478c-8104-60c8b0af87dd-0196/executors/e1c59945-8c1b-4a39-80d2-d2287c25935f/runs/89138348-266d-4684-825c-a7a9b0a2bccf/testoutput/test-support/jtreg_closed_test_hotspot_jtreg_applications_runthese_RunThese30M_java/scratch/0/java.io.tmpdir -Duser.home=/opt/mach5/mesos/work_dir/slaves/da1065b5-7b94-4f0d-85e9-a3a252b9a32e-S35678/frameworks/1735e8a2-a1db-478c-8104-60c8b0af87dd-0196/executors/e1c59945-8c1b-4a39-80d2-d2287c25935f/runs/89138348-266d-4684-825c-a7a9b0a2bccf/testoutput/test-support/jtreg_closed_test_hotspot_jtreg_applications_runthese_RunThese30M_java/scratch/0/user.home -agentpath:/opt/mach5/mesos/work_dir/jib-master/install/jdk-27+3-160/linux-x64-debug.test/hotspot/jtreg/native/libJvmtiStressModule.so -Xverify:all -javaagent:redefineagent.jar -XX:NativeMemoryTracking=detail -Djdk.test.lib.random.seed=4784190 applications.kitchensink.process.stress.Main /opt/mach5/mesos/work_dir/slaves/da1065b5-7b94-4f0d-85e9-a3a252b9a32e-S35678/frameworks/1735e8a2-a1db-478c-8104-60c8b0af87dd-0196/executors/e1c59945-8c1b-4a39-80d2-d2287c25935f/runs/89138348-266d-4684-825c-a7a9b0a2bccf/testoutput/test-support/jtreg_closed_test_hotspot_jtreg_applications_runthese_RunThese30M_java/scratch/0/kitchensink.final.properties

      Host: ol8-x64-925931, AMD EPYC 9J14 96-Core Processor, 12 cores, 23G, Oracle Linux Server release 8.10
      Time: Fri Dec 19 14:42:09 2025 UTC elapsed time: 25.765880 seconds (0d 0h 0m 25s)

      --------------- T H R E A D ---------------

      Current thread (0x00007ff571bf6a90): JavaThread "C2 CompilerThread1" daemon [_thread_in_native, id=2503446, stack(0x00007ff57e3e5000,0x00007ff57e4e5000) (1024K)]


      Current CompileTask:
      C2:25765 7096 b java.lang.Thread::<init> (13 bytes)

      Stack: [0x00007ff57e3e5000,0x00007ff57e4e5000], sp=0x00007ff57e4dfe90, free space=1003k
      Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
      V [libjvm.so+0x1895589] PhaseCCP::verify_type(Node*, Type const*, Type const*)+0x169 (phaseX.cpp:2796)
      V [libjvm.so+0x189a439] PhaseCCP::analyze_step(Unique_Node_List&, Node*)+0x59 (phaseX.cpp:2865)
      V [libjvm.so+0x189e62a] PhaseCCP::analyze()+0x80a (phaseX.cpp:2855)
      V [libjvm.so+0xbb1575] Compile::Optimize()+0x965 (compile.cpp:2495)
      V [libjvm.so+0xbb4a73] Compile::Compile(ciEnv*, ciMethod*, int, Options, DirectiveSet*)+0x2023 (compile.cpp:862)
      V [libjvm.so+0x9cbd68] C2Compiler::compile_method(ciEnv*, ciMethod*, int, bool, DirectiveSet*)+0x498 (c2compiler.cpp:147)
      V [libjvm.so+0xbc3f60] CompileBroker::invoke_compiler_on_method(CompileTask*)+0x780 (compileBroker.cpp:2345)
      V [libjvm.so+0xbc57c0] CompileBroker::compiler_thread_loop()+0x530 (compileBroker.cpp:1989)
      V [libjvm.so+0x112843b] JavaThread::thread_main_inner()+0x13b (javaThread.cpp:776)
      V [libjvm.so+0x1bb0036] Thread::call_run()+0xb6 (thread.cpp:242)
      V [libjvm.so+0x1808458] thread_native_entry(Thread*)+0x118 (os_linux.cpp:860)

        1. hs_err_pid256306.log
          65 kB
        2. Test.java
          7 kB
        3. Reduced.java
          0.5 kB
        4. FuzzerUtils.java
          13 kB

            Assignee:
            Quan Anh Mai
            Reporter:
            David Holmes
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated: